Password generation and storage practices

Password strength depends primarily on length, uniqueness, and resistance to guessing. Reuse and predictable patterns create material risk even when a password contains several character types.

Recommended controls

• Length — use a long password or passphrase appropriate to the service requirements.
• Uniqueness — assign a different password to every account.
• Random generation — use a cryptographically secure generator for accounts managed through a password manager.
• Multi-factor authentication — enable an additional authentication factor where available.

Generator and storage workflow

1. Generate a value with the Password Generator.
2. Store the value immediately in a reputable password manager.
3. Confirm that the saved entry matches the intended account and domain.
4. Avoid transmission through email, chat logs, or shared notes.

Strength indicators

Password-strength indicators are estimates and do not guarantee resistance to compromise. Active passwords should not be entered into untrusted password-checking websites.

Primary reference: NIST SP 800-63B — Strength of Passwords.