Password for banking
A long unique password for your bank login. Though the password is not the main thing here — we cover what actually protects the money.
Space — new password · C — copy · M — hide
Password length
Character sets
Select at least one character set.
Passphrase settings
A 2048-word list gives exactly 11 bits per word (the Diceware method). Six words are 66 bits, eight are 88. The words are drawn by a cryptographic generator, not by a human — that is the whole point.
Password pattern
a — lowercase, A — uppercase, L — any letter, 9 — digit, # — symbol, X — letter or digit, * — any enabled character, c/v — consonant/vowel. Every other character is copied as is, \ escapes the next one.
Fine tuning
“Safe symbols only” keeps !@#$%^&*_-+=? — almost every site accepts them and they do not break shell commands, CSV or SQL.
Recent passwords (this tab only)
What happens to your password
The password is assembled in your browser from the cryptographic randomness source crypto.getRandomValues with rejection sampling, so every character is equally likely.
The page never sends passwords to a server, never writes them to browser storage and drops the history when the tab closes.
Password letter by letter
Phonetic spelling for reading a password out over the phone. Letter case is stated separately.
What matters here
Uniqueness beats length. The most widespread attack online is replaying login-and-password pairs from other breaches. Length is useless against it: the password is already known.
Sixteen characters where the bank allows it. Some banks cap the length at twelve or even eight. Take the maximum allowed — and note that a length cap usually means the password is not stored well.
Special characters are optional. If the form rejects them, add length: twenty letters and digits beat twelve with symbols. The version without special characters fits.
The password is not the main thing
Banks limit login attempts, require confirmation and watch for suspicious activity. So money is stolen around the password rather than through it — by persuasion over the phone.
What to set up besides the password:
Login confirmation in the bank app rather than by SMS. Notifications for every transaction, including small ones. Limits on transfers and online payments. A separate card for online shopping.
The techniques of a fraudulent call and the one-action rule that defeats the whole script are covered in bank account security.
Questions
Frequently asked questions
How long should a banking password be?
From sixteen characters where the bank allows it. Some banks cap the length at twelve or even eight — then take the maximum allowed and enable login confirmation. A length cap usually signals that the password is not stored well.
Why must a banking password never be reused?
Because the most widespread attack online is replaying login-and-password pairs from other breaches. Length does not help: the password is already known.
Which matters more, the password or the second factor?
The second factor. A password protects against guessing; a second factor protects against a password that is already stolen. Confirmation in the bank app beats an SMS code.
The bank rejects special characters — what now?
Add length. Twenty letters and digits beat twelve with symbols. A narrower alphabet is almost entirely offset by length.
What if the banking password may have leaked?
Change it, end all sessions, review transactions and linked cards. And check whether it was reused elsewhere — it usually was.
Next