New Generators
Keyboard Walk
Five new generators built on random adjacent walks across the keyboard. Secops published a report on keyboard pattern passwords. Examples of such passwords are qwerty, 345ertdfg, and P)o9I*u7Y^. The question then arises, "can keyboard pattern passwords be secure in practice?".
The answer is of course "yes", but it requires a CSPRNG to make a decision at each key to pick which adjacent key to move to and whether or not it should be modified with <Shift>. The same physical key for the next character is not an option.
This means the middle keys provide 3 bits of entropy, the edge keys provide ~2.58 bits of entropy, and the corner keys provide 2 bits of entropy (excluding the key above the left <Tab> which provides 1 bit). It is roughly similar to, but has slightly less security than the base-8 generator. Depending on how many middle, edge, and corner keys are used in the generation process, the length of the password will vary for the same security margin.
The following English keyboard layouts are explored:
The Secops report also explored the AZERTY and QWERTZ keyboard layouts, in addition to QWERTY. It would be nice to include these layouts in this generator as they are much more common than the alternative English layouts mentioned above, but it doing so comes with some challenges:
- Modifier keys in addition to
<Shift>for 3rd, 4th, and even 5th levels. - Dead keys modifying the next character typed (circumflex, diaeresis, grave, acute, and tilde).
- Localization variants.
Pull requests welcome if AZERTY and QWERTZ is important to you.
Backronyms (was Acronyms)
The logic was completely rewritten inspired by @Sc00bz with his approach found at https://github.com/Sc00bz/acronym-passphrase/. Rather than picking a random word first to build the backronym from, build up the key spaces for every word from the shortest length (1 character) to the longest length. Then we can deterministically pick a backronym word from the right key space based on the user-picked security margin.
In addition to giving the user the passphrase from the backronym, a new feature was added where the backronym is printed in the box, so the user doesn't have to manually figure it out. Whether or not the user decides to use the backronym itself in their passphrase doesn't hamper security.
French Diceware Update
As per the upstream Diceware project provided by Arnold G. Reinhold, the French word list was updated to the 8,192 word list supplied by Tango for Tails OS and the Tor Project.
As more 8,192 word lists are added by Arnold to https://theworld.com/~reinhold/diceware.html, they'll be added here given that's they're core intent. If you're tossing physical d6 dice, then the 7,776 word lists should be used.
Emoji Update
The emoji character list and corresponding Google Noto Color Emoji font were updated to support the emoji 17.0 release on September 9, 2025. This brings the number of characters up to 3,944 unique characters.
Progressive Web App (PWA)
The project is now available as a PWA that you can install locally on your device instead of https://atoponce.github.io/webpassgen/. This is a trial run to see if I like this or not, but figured I'd make it available for those who want it rather than trying to download the latest release and open the HTML locally (which is fine, but a PITA on mobile devices).
Bug Fixes
- Fix Monero mnemonic passphrase bug
- Generic code cleanup
