There are two password generators on ss64.com:
How they work
This section explains how the passwords generator work, such that it is possible to roll out a standalone version that does not depend on relying on a third party web site.
- You have a master password, let's say
- You generate a password for a specific site or service, let's say
You compute the SHA1 sum (standard version) or SHA256 sum (strong version) of the string
$ echo -n "foo:stackexchange" | sha1sum #standard version b99341502484edbc43ec35a5f94be8e5de7ca53a *- $ echo -n "foo:stackexchange" | sha256sum #strong version c6ac66fdb639821bcc322f186fb1214d241f35ba2a91cb660daf0a284ac19a47 *-
You apply Base64-transformation on the sequence of bytes of which the hexadecimal representation is the previously generated checksum:
$ printf "\xb9\x93\x41\x50\x24\x84\xed\xbc\x43\xec\x35\xa5\xf9\x4b\xe8\xe5\xde\x7c\xa5\x3a" | base64 uZNBUCSE7bxD7DWl+Uvo5d58pTo= $ printf "\xc6\xac\x66\xfd\xb6\x39\x82\x1b\xcc\x32\x2f\x18\x6f\xb1\x21\x4d\x24\x1f\x35\xba\x2a\x91\xcb\x66\x0d\xaf\x0a\x28\x4a\xc1\x9a\x47" | base64 xqxm/bY5ghvMMi8Yb7EhTSQfNboqkctmDa8KKErBmkc=
(strong version) you replace + with E and / with a, and take first 20 characters
- (standard version) you take first 8 characters and then add
1aat the end of the password to ensure there is at least one digit and one letter
Therefore, with master password
foo, and for specific site
stackexchange, the standard generated password is
uZNBACSE1a and the strong generated password is
Now the questions
- Is the strong version really stronger than the standard version? Would it still be stronger if the standard version also used SHA256?
- provided that I choose a good master key (not foo, rather more than 10 random characters), am I rather safe with these generated passwords?
- What can be other drawbacks of this approach towards creating passwords?