22

I usually generate strong passwords using various online tools. Some time ago I mentioned it to a friend of mine and he was shocked that I do such dangerous thing. Is it really so unsafe to generate passwords online? Could there be generated some kind of cookie that tracks where I pasted it?

Improve this question
2
  • 2
    Given that there's good offline tools like KeePass there's no reason to take the risk to use an online tool.
    – Christian
    Commented Dec 15, 2015 at 21:25
  • 2
    What benefit do you think you get from using an online tool versus a local one?
    – Adam Shostack
    Commented Dec 15, 2015 at 23:19

4 Answers 4

Reset to default
27

No. It is not safe to generate passwords online. Don't do it!

In theory there are some ways that one could perhaps build a password generator that is not so bad (e.g., run it in Javascript, on your local machine, and so forth). However, in practice, there are too many pitfalls that an average user cannot be expected to detect. Consequently, I do not recommend it.

For instance, an average user has no way to vet whether the password generator does indeed ensure that the password never leaves your site. The average user has no way to verify that the web site is not keeping a copy of your password. The average user has no way to verify that the password generation code is using good entropy (and Javascript's Math.random(), which is the obvious thing to use for this purpose, is not a great pseudorandom number generator).

Improve this answer
5
  • All these seem good reasons for security.SE, whose users CAN check those things, to suggest one good website. :)
    – Nemo
    Commented Nov 8, 2015 at 8:50
  • 3
    @Nemo that's a dangerous proposition. Now you're asking people to trust a site that could go rogue, could be compromised, etc. Better to do it offline.
    – Ohnana
    Commented Dec 15, 2015 at 22:16
  • @Ohnana I'm not asking anything. And doing it offline isn't any better if one uses proprietary software.
    – Nemo
    Commented Dec 16, 2015 at 21:54
  • @Nemo while I wouldn't recommend using proprietary software to generate passwords, I would argue that it is safer than using a website, as the website could choose to send you a backdoored generated whenever it wants. At least with the offline software you aren't updating it every time you run it, so you only have to trust that the version you installed is safe.
    – AndrolGenhald
    Commented Jun 12, 2018 at 14:20
  • What makes you say it's not safe, when it's just the password and the site has no idea what the username is, what site/app/service it's going to be used with, how to access said site/app/service, etc.? I understand that the password may still be added to a dictionary or hash table, but without the rest, is it really much of a concern?
    – Jesse P.
    Commented Feb 17, 2019 at 1:53
0

Just because a password generator doesn't use JavaScript doesn't mean it's not safe, however it would be easy for the server to store the password sent out with your IP address. If this is a concern it would be easy to change a few characters in the password. The GRC Ultra High Security Password Generator does not use JavaScript but "this page will only allow itself to be displayed over a snoop-proof and proxy-proof high-security SSL connection, and it is marked as having expired back in 1999". Each "instance" of this page has multiple passwords so even if GRC did log them (which I doubt they do) they wouldn't know which one you've chosen to use. If you still want a JavaScript based generator here is one.

Improve this answer
5
  • 3
    That page displays just fine when accessed over Tor via the Internet Archive. Some "proxy-proofing" done there. And "the techie details" go to some length to argue that the passwords provide... what work factor exactly? 512 bits? How can a password of 256 bits (like the 64 hex digits one) provide 512 bits of security, no matter how it's generated? Nowhere on the page do I even see what character set is being used for the other two alternatives.
    – user
    Commented May 17, 2018 at 8:49
  • @MichaelKjörling It can't. In fact, the secrets (including the "secret IV", and note that IVs are not meant to be secret) are likely generated with the kernel's random number generator, which uses a 256-bit cipher on Linux, Windows, and most BSDs. I'd also just like to point out the absurdity of intentionally using a certificate expired in 1999 and calling it "high-security".
    – forest
    Commented May 18, 2018 at 9:25
  • @forest Exactly. It's a lot of impressive-sounding words which appear to have very little or even no basis in reality, and relevant information (like which character set is used when generating the passwords) is omitted. Regarding the 1999 though, I suspect that's a Cache-Control header or some of its ilk, rather than being in reference to the server certificate. (Not to say that a simple "no-cache" wouldn't work just as well; if you can't trust a proxy to get that right, there is no reason to assume that it gets date-based expiration right either.)
    – user
    Commented May 18, 2018 at 9:35
  • 1
    My god, every new "Gibson Research" password-related site I see gets an even bigger facepalm than the last one. I'm not sure whether he's a master troll or if he actually does almost understand a bunch of password concepts and somehow manage to get all the advice he gives subtly wrong anyway.
    – Ben
    Commented Sep 17, 2018 at 16:19
  • 1
    Some of the advice on that site seems dangerous, as @Ben noted above me. While the site appears to have good intentions, I am not sure it is reliable. One example: the site claims a user-chosen predictable password ("D0g" followed by some number of "."s) is more secure than a long randomly generated password because it is one character longer.
    – Iiridayn
    Commented Feb 6 at 1:18
0

You can try this tool https://thedevband.com/generate-password.html This tool works offline, so you can try the following:

  1. Open the tool on any browser.
  2. Disconnect internet.
  3. Use the tool to generate a password.
  4. Clear all cache on your browser.
  5. Connect to your computer to the internet again to continue your work.

By this way, this tool can not collect and store your passwords. The tool is legit but you can do these steps just to make sure.

Improve this answer
1
  • 2
    While I believe you are correct that this would prevent them from logging generated passwords, they still may be able to use a generation method that appears random to you, but that they can easily break. This is of course true of any password generator that isn't audited, but unfortunately anything web-based relies on the website to supply you with the code, so you can't even be sure you're running the same code as everyone else that visits the site (which makes it impossible to audit).
    – AndrolGenhald
    Commented Jun 12, 2018 at 14:14
-1

If the password is being generated locally in JavaScript and there is no traffic back to the server, you should be fine.

If the password was being stored in a cookie it would only be viewable from the site that it originated from, due to the same origin policy. You would also be able to detect this by checking your cookies.

Their is the possibility for disclosure of information if you use a bookmarklet such as the one at http://supergenpass.com (JavaScript in a bookmark). The bookmarklet is stored locally, but run in the context of the site you are at, so if there is JavaScript running from that site that is setup to detect your bookmarklet, it could access information that the bookmarklet, uses, prompts for, and generates.

Improve this answer
2
  • "You would also be able to detect this by checking your cookies." how would you do that?
    – curiousguy
    Commented Jul 31, 2012 at 22:06
  • 2
    Like other answers, this overlooks the possibility of a backdoored password generator.
    – AndrolGenhald
    Commented Jun 12, 2018 at 14:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .