This site is under development.
The original strongphrase.net makes outdated assumptions about attacker capabilities. I like the tool (specifically its username/identity generator) but cannot in good faith endorse the quality of its password generation.
The original strongphrase.net also includes 1Password as its first password manager recommendation, which I consider questionable. The closed-source nature of 1Password makes it hard to know that its encryption is implemented in accordance with current best practices and doesn't have a bypass technique that I am unaware of.
I plan on hosting my own version of strongphrase.net with improved password generation and better informational resources but in the meantime this site is just a placeholder.
TL;DR: While strongphrase.net contains useful tools, some of which I even use myself, I'm not comfortable endorsing it in its current state.
FAQ
What outdated assumptions does strongphrase.net make?
Strongphrase.net bases its password strength around the estimated capabilities of high-end consumer hardware. This places certain demographics (activists, journalists, whistleblowers, etc.) at unnecessary risk because it fails to account for higher threat models. According to its own time-to-crack estimates, its own passphrases fail to secure against nation-state attacks with even its strongest passphrases failing in less than a year of attacker effort (law enforcement is known to spend many years, often well over a decade, trying to break into devices they've seized.
Strongphrase.net password strength against nation-states (by their own estimate)
| Type | Entropy | Time to crack |
|---|
| Strong | 48 bits | 1 minute |
| Stronger | 58 bits | 20 hours |
| Strongest | 66 bits | 200 days |
(This table doesn't include financial cost-to-crack statistics because calculating this cost relies on unreliable and often optimistic assumptions that can make attacks seem more expensive than they actually are)
While strongphrase.net does a decent job assessing security against financially-motivated attackers, it's more useful to someone defending a corporate network.
Is it really reasonable to expect users to use even more complex passwords?
The truth is all passphrase generation schemes fail for the same reason: secure passwords require high entropy, and people are just bad at remembering complex things. The passphrase game is to trade-off a completely random block of characters for a longer string of words that roughly mimics the structure of written text.
This can (sometimes) make passphrases easier to remember, at the expense of having more for users to type.
Personally I think the problem of passphrases is one that's already been solved as best as is possible. The generally accepted security advice is to use a password manager to sidestep the problem of memorizing and constantly typing complex passwords; making passphrases pointless and obsolete.
Why is it taking so long to develop this site?
Because strongphrase.net is built in a stupid way they make it particularly difficult to simply patch in the necessary changes. This is a common symptom of overreliance on JavaSceipt/web frameworks.
I don't have all the time in the world to work on this so I need to figure out a way to programmatically patch in the necessary fixes every time strongphrase.net updates their own code, in order to keep my version consistently synced with upstream without requiring me to manually rebase.
What's wrong with web frameworks?
While there's nothing inherently wrong with frameworks as a concept, most web frameworks treat web development like writing compiled code, except using event-driven JavaScript as the primary building block. JavaScript was never designed to be the primary basis of web development (it was always meant to take a backseat to HTML) and it certainly was never meant to be compiled. In the name of "making development easier" (ie. replacing one boilerplate with an even larger but higher-level boilerplate), developers have successfully increased their application size 50x, added an entirely pointless build step, and made life harder for downstream developers like myself.
What is a "password" vs a "passphrase"?
When I say "password" I'm referring to any secret that you memorize (or save in a password manager) in order to authenticate with a service or unlock encryption.
A "passphrase" is a type of password that attempts to be easier for people to remember, usually by using English words and sometimes by partially mimicking English grammar.
While some people say "password" to mean specifically "not a passphrase", I conider passphrases as a type of password - that is: all passphrases are passwords, but not all passwords are passphrases.
Are TOTPs/HOTPs/2-factor codes passwords?
No, 2-factor codes such as TOTPs/HOTPs/those codes you get over SMS/email are not passwords. Because the codes change every time you use them, the codes are never meant to be memorized or saved anywhere.
When you save TOTPs/HOTPs in an auhenticator app what you're doing is saving a different secret that's used to derive the code you type in to authenticate. The actual OTP secret is never used directly.