Is it better for me to bang on the keyboard for 12 characters or use my password manager's generator?

Question

I use a password manager with a long rememberable master password for logging into all of my online accounts. When signing up for new accounts my password manager prompts me to generate a strong password which it then autofills. This auto generated password is a twelve character long alphanumeric string. Is there higher risk in me attempting to generate a random password by randomly pressing twelve characters on on the keyboard vs a potential flaw in the generator that would allow password discovery with some other available information (password creation time, password length, creation method)?

I know in the ideal case the password generator is far superior to my attempt to be random on the keyboard, but is my hand dropping on the keyboard so much worse that the risk of my password manager's generator being flawed is the better of the two options? I know this might be an opinionated question so any facts, studies, or personal knowledge on this topic would be highly appreciated. I did attempt to Google this question and my searches along the lines of "password generator vs random typing" yielded no good results.

PS: Where as I don't use them it might be cool if answers also addressed random typing vs going to Google, searching "password generator", clicking one of the top results, and then using a web based random password generator.

Answer 1

is my hand dropping on the keyboard so much worse that the risk of my password manager's generator being flawed?

It all comes down to probabilities. If I know that you are mashing your fingers on the keyboard to generate passwords, then I would guess that keys in the red circles are far more likely.

I also know that if you start with a J, then there's a very high likelyhood that the next letter will be H or K. I know that if there are CAPS or symbols, there are probably a bunch of them in a row. I know that Q or / are very unlikely.

When you talk about a flaw in the random number generation routine of your password manager (something that has received a lot of scrutiny, for any widely-used password manager), you're talking about probabilities (properly called biases) way smaller than the probability that letters are clustered when you bang on the keyboard.

Answer 2

The password generator is better. It will use a system designed with the sole purpose of generating random chars. Your brain is not designed for this.

If you mash the keyboard a hundred times and create a heatmap of the typed keys, you will see the keys most used is the central ones, and the peripheral ones less so.

Open your text editor, and generate more than 30 passwords with your method. Then run this script:

awk -vFS="" '{for(i=1;i<=NF;i++)w[$i]++}END{for(i in w) print i,w[i]}' file-you-saved | sort -g -k2

It will take all the chars, count them, and sort them based on frequency. For your method to beat the password generator, the letters should have more or less the same frequency.

If the site you are logging in allows for more chars, do it. I use 64 when allowed, or the maximum allowed when it's less than that.