Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Questions about the strength of pass phrases frequently popup, as does: how to generate a strong passphrase? I tried to combine both in a tool. The free tool also includes recovery time estimations for some common cases and hardware. The tool is available here.

As has been said over and over again, these strength & recovery calculations are averages, and only apply if the words are chosen at random. The tool offers 2 options for random choices. The online mode uses Offline mode uses the Excel RND function. I have 2 questions.

Commenters state that "Entropy is a property of the generation process". I agree that it is not (only) a property of the passphrase. But isn't strength (entropy) above all, a property of the combination of passphrase and recovery process?

The random choice option in the tool is a 2 step process when using the Internet as a source. The first step gets random (dictionary word) numbers from the Internet. To make the final pass-phrase choice less NSA-able, the dictionary sequence is randomized before words are picked from the dictionary by their random word number from step 1.

For sure the first step delivers a random choice. But is the final choice still a random choice when I randomized the dictionary before choosing? (using a local random pseudo generator)

share|improve this question
Every non-dictionary password is good. There exist much faster way to get inside then to crack passwords :) – Jiri Xichtkniha Oct 8 '13 at 12:36
Don't agree or recommend that to access password vaults for example. And how do you know your password is not in a 1.5 billion long 'dictionary'? By using a passphrase! – Dick99999 Oct 8 '13 at 14:58
My comment was about that too complicated passwords make people not to remember them and write them down on a paper closed to computer :) This is reality. Way forward is to use dual-factor authentication (something you know, something you have). – Jiri Xichtkniha Oct 9 '13 at 8:25
What about apps that use a (derived) password as an encryption key, like a password vault. 2-factor authentication is fine to protect regular access to the vault. But if the encrypted vault is stolen, you still depend on the passphrase only, don't you? – Dick99999 Oct 10 '13 at 11:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.