Password for a service account
A mobile operator, utility, insurance or clinic portal. Your documents and a saved card live there, and the password is usually the oldest one you have.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
Why portals are the weak link
People sign into an operator, utility or insurance portal once a quarter. The password is set once and never touched — usually the oldest one you own.
Meanwhile the portal holds identity documents, an address, payment history and a saved card. An operator portal also controls your phone number, the one confirmation codes arrive on.
Working around form limits
Portals often cap the length or reject symbols. One rule: take the maximum allowed and add length instead of symbols — the version without special characters fits.
Enable a second factor wherever offered. On an operator portal it is essential.
Questions
Frequently asked questions
Why does a weak portal password matter?
Such portals hold identity documents, an address, payment history and a saved card. A mobile operator portal also controls the phone number, and numbers are used to recover access to other services.
Why do portals end up the weakest link?
People sign in once a quarter, set a password long ago and never touch it. Meanwhile these services appear in breaches regularly.
What length should I use?
Sixteen characters or more where the form allows. Many portals cap the length or reject symbols — then take the maximum and add length instead.
Is a second factor needed?
Yes where offered. On a mobile operator portal it is essential: control of the number lets someone intercept confirmation codes from other services.
Next