Skip to main content

How to Generate a Password or a Passphrase

passbolt generates secrets in two flavours: a random password, and a passphrase made of random words. Both are available while you create or edit a resource, and each has its own settings.

Draw a value​

The dice button, on the right of the password field, fills the field with a freshly generated secret. Click it again and you get another one. It uses whatever settings are currently in force, so a single click is often all you need.

The Advanced password generation section open on the password tab, with the length slider and the character type toggles
fig. The generator, in password mode

Change the settings​

The settings live in Advanced password generation, a section of the resource form that starts folded. Unfold it and you get two tabs, password and passphrase, one for each mode.

Two things are worth knowing before you touch anything:

  • Changing any setting generates a new value immediately. The field never keeps a value that does not match the settings on screen.
  • There is nothing to apply or confirm. The generated secret is already in the field, and it is saved when you save the resource.

Password mode​

  • Length: a slider and a numeric field, side by side and synchronised, so you can drag or type. The range depends on the policy your administrator has set, and is 8 to 128 characters by default.
  • Character Types: ten toggles, labelled with the characters they stand for rather than with words. In order: A-Z for capitals, a-z for lower case, 0-9 for digits, then six families of punctuation and symbols, # $ % & @ ^ ~, { [ ( | ) ] }, . , : ;, ' " `, / \ _ - and < * + ! ? =, and finally one for emoji.
  • Exclude look-alike characters: a checkbox that keeps the easily confused characters out, the likes of l, 1 and I, or 0 and O. Worth ticking for a password somebody will have to read out or retype, pointless for one that only ever travels by copy and paste.

Passphrase mode​

  • Number of words: again a slider and a numeric field, from 4 to 40 words by default, within the range your administrator allows.
  • Words separator: a free text field, so the separator can be a dash, a space, or nothing at all. Its initial value comes from the policy of your organisation.
  • Words case: Lower case, Upper case or Camel case.
The Advanced password generation section open on the passphrase tab, with the number of words, separator and case settings
fig. The generator, in passphrase mode
Passphrases are always built from English words

The word list does not follow the language of your interface. Whatever language passbolt speaks to you in, a generated passphrase is made of English words. This changes nothing about its strength, but it does make it harder to memorise or retype if you do not read English, which is a fair reason to prefer the password mode.

Where the settings come from​

The values you find when you open the panel are not hard-coded, they are the defaults your organisation has chosen, described in the password policy settings. You can always depart from them for one resource, which is what the panel is for: a service that refuses some characters, or demands an unusual length, should not stop you.

Depending on the same policy, passbolt may also check the secret you are about to save against a database of leaked passwords, and warn you when it recognises it. Only a fingerprint of the secret is sent for that check, never the secret itself.