Generating Strong Passwords and Passphrases

Weak and reused passwords are the single biggest credential risk. StretchVault's Generator removes the guesswork: it produces cryptographically strong values on demand, so you never have to invent one yourself.

How the generator works

Every value the generator produces is created with a cryptographically secure random number generator (CSPRNG) — the same class of randomness used for encryption keys — so the output is genuinely unpredictable, not a pattern a person might reuse. The generator can produce two kinds of secret:

• Passwords — random character strings, ideal for anything you'll copy and paste (most logins, API-style secrets).
• Passphrases — several random words joined by a separator, ideal for secrets a human occasionally types (a laptop login, a Wi-Fi password).

Generating a password

1. Open the Generator tab.
2. Choose the Password type.
3. Set the length. You can choose anywhere from 8 to 128 characters; the default is 20, and 16 or more is recommended for anything important.
4. Toggle the character classes you want: uppercase, digits, and symbols. Lowercase is always included, and the generator guarantees at least one character from each class you enable.
5. Optionally raise the count to generate several candidates at once (up to 50).
6. Click Generate, then copy the value you like into your item's secret field.

The generator also shows a sample strength score and estimated entropy for the first result, so you can confirm at a glance that it's strong.

Generating a passphrase

1. In the Generator tab, choose the Passphrase type.
2. Set the number of words — between 3 and 12; the default is 5. More words means a stronger, longer phrase.
3. Choose a separator (for example a hyphen -).
4. Optionally enable uppercase to capitalize one word, and digits to append a number to the end.
5. Click Generate and copy the phrase.

A five-word passphrase like granite-otter-Cove-thistle-lunar42 is far easier to type and remember than a random string, while remaining very hard to guess.

A realistic example

Meridian Studio is rotating the password on their production database (a Server item). Because a person occasionally types it during maintenance, they use the Passphrase generator with 6 words and a hyphen separator, producing silver-meadow-Quartz-fern-harbor-drift19. They paste it into the item's secret field, save, and update the server. For their Stripe API key rotation the next day, no human ever types it, so they use a 32-character Password with all character classes enabled.

Reading the strength result

When you save any secret (generated or typed), StretchVault scores it:

• Strength score — 0 to 100, labelled very weak, weak, fair, strong, or very strong.
• Entropy — an estimate of how much randomness the secret contains, in bits.
• Crack time — a rough estimate of how long an offline attacker would take, from instant to centuries.
• Findings — specific problems such as "too short," "contains a keyboard pattern," or "contains a year-like number."
• Breach match — whether the secret appears on common-breach password lists (if so, its score is capped near zero and the item is marked exposed).

Tips

• Default to 20+ character passwords for anything a machine handles, and 5–6 word passphrases for anything a human types.
• Enable all character classes for machine passwords — there's no downside when you're copying and pasting.
• Generate a batch (raise the count) when you need to set up several accounts at once.
• Never reuse a generated value across items. Reuse is one of the exact conditions Watchtower flags.

Troubleshooting

The generator isn't producing results. Password and passphrase generation depend on the security engine being enabled. If nothing generates, open the Health tab and check the engine status; if it's off, contact your workspace administrator.

My generated password still scores lower than expected. Very short lengths or disabling most character classes reduces entropy. Increase the length or re-enable digits and symbols and generate again.

FAQ

Are generated values stored anywhere before I save them? No. The generator returns candidates to your screen; nothing is stored until you save an item with that value.

Can I generate a value that meets a site's specific rules? Adjust length and character classes to match the site's requirements — for example turn symbols off if a site rejects them.