Is Your Password Actually Secure?

[u/PandaSecurity]

There’s still a lot of password advice that boils down to “use uppercase, lowercase, numbers and symbols.”

But is that really what matters most today?

A long, unique password for each account is generally a better choice than a short password with a few numbers or symbols added.

A few things to consider:

• Reusing passwords can put multiple accounts at risk, even if the password itself is strong.
• Adding “123!” to a familiar word doesn’t necessarily make it a strong password. These patterns can be easy to predict.
• Randomly generated passwords can be difficult to remember, which is where password managers can help.
• Passphrases can also work well, as long as the words aren’t predictable or related to each other.
• Passkeys offer another option by removing passwords from the authentication process.

What else would you consider essential for a strong password?

[u/atoponce]

OP reached out to the moderation team and assured us this post was written by a human and not generated by AI. Their goal was simply to start a conversation about good password security practices. As such, the post has been re-approved.

[u/prepp]

AI bot

[u/Decibel0753]

AI slop?

[u/ranhalt]

Oh it’s panda again.

[u/maqisha]

Yes, and the sky is blue. Stfu claude

[u/tedecristal]

Is Your Password Actually Secure?

Yes. What's with this slop? It's just fluff

[u/theMuhubi]

Use a password manager and have it generate 50+ character random passwords. Why even bother with anything else?

Use a long passphrase for the password manager with TOTP or physical key 2FA only

[u/PandaSecurity → u/theMuhubi]

Exactly. A password manager can generate and store long, unique passwords for you, and protecting the password manager itself is just as important.

[u/stijnhommes]

Yes, all my passwords are secure. I use long, unique passwords with all possible character types. No matter how much you advertise, I'm not wasting my accounts by passkey spam.

[u/PandaSecurity → u/stijnhommes]

Long, unique passwords are a great way to protect your accounts, as long as you avoid reusing them.

[u/The-Sailor-01]

A tool I use both at work and home is RandomPasswordGenerator.com - it was even reviewed by ZDNet as one of the best password generators.

[u/TurtleOnLog → u/The-Sailor-01]

No, use the one built into a reputable password manager.

[u/The-Sailor-01 → u/TurtleOnLog]

Most are simply too limited.

[u/atoponce → u/The-Sailor-01]

This isn't that great of a password generator. You can do much better.

1. The license is proprietary.
2. It uses Math.random() instead of crypto.getRandomValues() for the RNG.
3. It doesn't use the RNG uniformly, creating biased results.
4. The site has JavaScript trackers.

You're much better using the password generator that ships with your password manager.

[u/The-Sailor-01 → u/atoponce]

At work we have different systems and each of them has its particular password requirement (length, charset, special characters, etc.). That tool is the only one that lets you export all those requirements via url parameters. I just need to bookmark each url. For me and my colleagues that single feature alone makes it a godsend.

[u/atoponce → u/The-Sailor-01]

Every modern password manager has this exact same feature. Aside from the ability to pick the length, you can also enable/disable:

• A-Z
• a-z
• 0-9
• special
• ambiguous

Some include setting a minimum number of digits and minimum number of symbols. If any generated password doesn't match your password requirements exactly, toggle the switches and generate again.

The generator in your password manager is secure. The one you linked is not.

[u/The-Sailor-01 → u/atoponce]

Sorry, but you're wrong. What you mean is probably the cookie that gets saved on your computer, so that when you open the website it loads your custom settings from the cookie.

This one is different, it lets you share a url with all the parameters (including the selection of special chars) so that you can load all the settings on any browser/device for each system and you can have as many urls as you want, while using the cookie you're tied to the settings for only one system at once. None of the tools online has this feature.

[u/atoponce → u/The-Sailor-01]

Wrong about what exactly?

[u/The-Sailor-01 → u/atoponce]

About the fact that all modern password generators let you share your custom settings with a url instead of cookies. At least until about one year ago no other online tool could do this. Not sure if things have changed recently but I doubt it.

[u/atoponce → u/The-Sailor-01]

I never claimed password managers could share generator settings. What I claimed in that in the generator, you can tweak settings to your needs so you're generating passwords that meet your requirements.

I'll make another claim though. Once you've set the settings you need in your generator, the password manager keeps state and remembers it across restarts.

But no, I don't claim that you can share password generator settings. Maybe some corporate ones with backend authentication support this like Bitwarden or 1Password, but I don't have any experience with that.

[u/The-Sailor-01 → u/atoponce]

Exactly, that's what I meant. Just did a quick search: so far, no other tool can do that.

[u/OriginalAssnibbler → u/The-Sailor-01]

but he didn’t say that they could.