Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are the methodologies which can be used to generate "human" good quality password?

They have to ensure a good strength and also easy to remember for a human being.

share|improve this question
2  
Create one really good one and let agilewebsolutions.com/onepassword do the rest. –  Tate Hansen Nov 21 '10 at 20:30
6  
Shouldn't this be a community wiki, since there's no one answer? –  Bill Weiss Jan 7 '11 at 21:36
3  
For every IT question, there is a relevant xkcd comic. –  StrangeWill Nov 29 '11 at 14:42
1  
Best advice I've seen on passwords xkcd.com/936 –  Wayne In Yak Nov 30 '11 at 16:01

41 Answers 41

Create some new words: splur, bambile, egilomanifastic, spilomasilomagnitolistable. Combine for a bit of fun rhyme and an easy mnemonic.

share|improve this answer

Here's yet another scheme for musicians:

qiurtyuqytnreqwerwmqweq
qqwnqqrtyyyttrrtyy7yytytrrtr
qweqqweqerterttytreqtytreqqbqqbq
32g5532g5532g5d5srr

Transpose or obfuscate further as desired.

share|improve this answer

Two more points:

a. Along with all other methods, one more way to increase entropy:

Go beyond just (plain) English.

If we combine (seed) words from more that one language the password guessing/search area immediately becomes HUGE. And that would certainly confuse people writing password guessing rules.

Then again that would require having a broader field of thinking than the "bad guys". Perhaps it comes down to "our" intellect against "theirs". Perhaps, the broader thinking should be:

Go beyond just CS methods.

So, what other such ways can we think to outsmart password guessing?

b. One point not seen mentioned so far: Thinking from the administrator's side, let's not forget that any password generation rules may also have to adhere to the password policy of your organization. E.g. I have difficulty thinking how the method words-separated-by-spaces (using uncommon words!) could be easily implemented and enforced in an enterprise environment (OK, parsers, dictionaries etc. but you get the idea...)

And how about educating and convincing users to use this or any other method...?

share|improve this answer

change your life :) have all password be extremely complicated, now way to remember any of them. Get a password manager, I found KeepAss pretty useful.

You can keep DB files at dropbox and use password + picture (binary file) to access passwords, keep picture (file) only on devices you likely use to access password from (not at dropbox!).

Keep picture accessible but not obvious. So system is still usable but hackers if get you password DB files can not get access to it by brute force.

This case you will need only one password to remember! which is much easier.

Change it and file regularly and you safe.

DropBox keeps history of your data for a month (?) so remember it when changing DB password.

share|improve this answer

Let you choose a verse from your favorite song in the history or just in this period of time.

Take a random sentence, make some CamEl cAse permutation, you can even use a script kiddie charset substitution to m4k3 1t l00k1ng so CoMpl3X and difficult to guess.

Ideally, you write an English sentence, like: this morning I am so blue. Actually your password can be: Th1S M0rn1Ng I 4M s0 Blu3.

Easy to remember and after some input also easy to type.

share|improve this answer

I used to take four random words, substitute some of the letters for numbers, and append four numbers plus a special character. The problem was, that was a bit difficult to remember - now, I have take my favourite line from the book I was reading the previous month and do a similar substitution plus some capitalisation changes, e.g:

"A human head rises up from a swamp of sleep" (number9dream, David Mitchell) becomes "Ahum4nH34dR1s3sUpfR0mASw4mpOfSl33p!"

It has acceptable entropy and the computational complexity of a brute-force search means that such an attack is impractical.

share|improve this answer

My way is to change some letters with similar numbers and every new word start with uppercase.

for example: Th1sIsGreatPassw0rd!

i=1,

0=o

and at the and '!' or something else.

share|improve this answer

First reccomendation is something like lastpass or keepass, but I know those aren't always practical and my less technically savvy friends certainly don't want to "complicate things any more" so I have found that a substitution cipher works fairly efficiently and allows for easy remembrance of your password while making it very unlikely for it to be guessed or easily hacked.

I put an example out there http://levii.com/cipher.php ... I use at least a 4 letter key word (so "BANK" for my bank "WORK" for my work) which I don't bother changing -- I keep the card in my wallet and print a new one up every couple of months when its time to change the password. (note: this is not the actual app I use to generate my cards, but is conceptually the same)

share|improve this answer

My way is in no way unbreakable, primarily because it relies on security through obscurity, but it is better than password reuse and doesn't rely on keeping much remembered. I xor a repetition of the url of the site in question with a long password of my choosing. In this way, you only remember one password yet a compromise of one site's password store doesn't compromise your other logins. This has potential for infinite variation. You could do the url followed by the ip address, the url reversed, the url translated to spanish, etc, etc.

share|improve this answer

If English is not your mother tongue,you are lucky. I would suggest using a passphrase that uses a combination of English words with words from your native language or languages. Such a password will be quite difficult to guess.

Of course you should choose a passphrase that can be remembered easily by you.I am not a big fan of creating too complex passwords, just remember that the password should not be easily guessable and should not be listed in a dictionary.

I also recommend not to have a single password for all your accounts. I maintain a small pool of passwords (this will come with practice). Your net banking password should not be reused for your eBay or monster.com account. Once I clicked on forgot password link of a job site and they sent me my password in plaintext. Basically you cannot trust every random website out there!

share|improve this answer

I have a long password I use which I can type in from memory each time which I created by remembering a specific zig-zag path across the keyboard, one which passes through letters, numbers, and symbols, and then tapping out the keys that make up that path in the rhythm of a drum pattern from a favorite post-dubstep track of mine, shifting some of the characters according to where the snares are in that drum pattern.

This is a different 'path' to what I use, but you can see how complex a password this technique gets you, and with a little bit of practise it's quite memorable:

]={-p)o9I8u&y6T5r$e3W2q

Then for different applications I'll I will usually add at the end my old hotmail password I came up with when I was 11, or my date of birth backwards, or something like that that I can remember easily.

share|improve this answer

protected by AviD May 5 '13 at 10:15

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.