xkcd-style Password



Your new password is SplendidRepairSynodSunder
Your bonus password is SplendidRepairSynodSunderDouble

If you don't like the new password, try a different one. If this isn't a sensitive application, you're probably fine if you only use the first four words. If you're very afraid, use the bonus version.


What's this all about?

This site was inspired by an xkcd comic about passwords. Conventional passwords are all but dead. Anything of the twelve-characters-with-upper-and-lower-case-and-two-non-consecutive-digits-a-punctuation-mark-and-a-supershift-character variety that's good enough to stump a computer is too complex for a human to remember.


What's new here? (21September2014)

There was an interesting discussion on Bruce Schneier's blog about xkcd passwords, in which he said "This is why the oft-cited XKCD scheme for generating passwords -- string together individual words like 'correcthorsebatterystaple' -- is no longer good advice. The password crackers are on to this trick." Bruce got it wrong. The xkcd system doesn't depend on the crackers not being "on to this trick." Bruce's criticism would only apply if the words weren't picked randomly, as might happen if someone thought that they were able to pick words at random in their head without using a good external source of randomness (dice or a properly programmed computer). Word to the wise: your brain isn't capable of cryptographic levels of randomness.

A consensus of the discussion was that four words is probably inadequate for sensitive applications. Thus, there's now a bonus word. Bonus!


How do I use my awesome new password?

That's passwords, plural. Never, never, ever use the same password for more than one site. Even variations on the same password, no matter how clever they may seem to you, are easy marks. That means you'll have lots of passwords (I have well over 1,000), and you'll need a password manager. You could use a sheet of paper (really!), but password management software is better.

I use 1Password. It keeps all my passwords locked away in encrypted files; I can then use a free Dropbox account to access the passwords from Mac, Windows, Android, or iDevice or from a web browser. I'm sure there are other programs with similar features. The only password I have to remember is my password manager's master password.


How do I get my passwords from my password manager into a web site or program?

Most password managers have pretty good integration with web browsers, or at least let you copy-and-paste. Let's say, though, that you're at a sleazy dive of an internet café using a shared machine and you want to log in to a low-value web site. You don't mind typing in the site's password, but you sure don't want to type your master password. You can take out your smartphone and grab the password from there. The four-word password easy to remember for long enough to type it in.


What about "security questions"?

They still use those? I thought that idea was completely discredited in the noughties. Any holdouts should have gotten a clue after the Palin Email Hack. I just use one of these passwords as an answer to each security question (they're even easy to read over the phone, if necessary) and store the questions and answers in my password manager's comments field. What's it to you if my first pet was named OpposedPilesJacksCarnage?


What if I just can't remember my four-word master password?

Try a few different passwords until you see one that tickles your fancy. When you do, try to create a mnemonic to help you remember it, as in the cartoon.

Still can't remember it? How about just memorizing the last word? It's only one word. Got it? Write the first three words on a slip of paper and keep it with your credit cards. Just remember to change it ASAP if the paper lost or stolen, like you would with your credit cards.


What about sites that require digits and punctuation?

I put €0? between the first and second word.


Why should I trust you to generate my passwords?

You shouldn't. This site is actually part of Ron's Master Plan for World Domination™. The random number generator is skewed so that I can crack these passwords in minutes. As Zuckerberg proved, though, wave a shiny bauble in front of someone's eyes and they'll line up to sacrifice their privacy for convenience. Bwahaha.

Note well the immortal words of Robert A. Heinlein, "The best way to lie is to tell the truth unconvincingly."


I can't trust you. How can I generate my own awesome passwords?

Here is the source code.

Creative Commons License
This work is licensed under a Creative Commons Attribution 3.0 United States License.