» The idea

A new way to design passwords!

The generator we have designed formulates passwords that follow the previous recommendation when set to use the 'usg' data set. Consider the following examples:

rTQ*yx#h, E7mD#S%x, q*0S@^k9,...

If you look at these examples, it's easy to imagine that using or memorizing such a password would be difficult.

The idea (patents pending) is to find a way to generate passwords with the following properties:

1. A password must have at least the same strength as those recommended (more than 723 trillion possible choices);
   
2. Characters are selected and ordered such that users are easily able to memorize the password; and
   
3. Considering the known methods used to "guess" a password, the one generated must be at least as hard to "guess" as the one recommended.
   

Basically, we have designed a rule-based password generator.

The rules we use in this web site allow the generation of "kind-of-pronounceable" passwords, depending on the phonetics of four languages (English, French, German, Spanish). In doing so, the three criteria listed above are satisfied as follows:

1. The length is customizable; therefore the strength of the generated passwords can be increased (criterion 1);
   
2. Passwords are made to be more easily memorized (criterion 2); and
   
3. The generator easily accepts new customized rules (criterion 3).
   

Below we provide a more detailed explanation of the generator functioning.

The details:

This generator uses data sets. Each set is referenced by a name (usg, eng, EnG,...).
Each set contains at least one alphabet and at least two rules.

The principle behind the generator is the production of a list of patterns from a given data set; the patterns are composed from a given alphabet set and generated by a rule set. The patterns are used to generate random passwords.

1. An alphabet is composed of similar units.
   A unit can be a letter or a figure or a symbol or any combination thereof.
   Two units are similar if they have the same length.
   example : 'ou' and 'ay' are two similar units of length two and may be part of the diphthong alphabet.
   

   Each alphabet is referenced by a 1-character length name.
   An example would be 'D', for the diphthong alphabet.

2. There are two kinds of rules: one that is used to initiate the pattern's generation process, and the ones that follow.
   Each rule is referenced by a 1-character length name, which is * for the starting rule and one of the current set alphabet name for the following ones.
   The rule's name determines its application in that process.
   For example, if the rule's name is D, it will be applied in the pattern generation process only if the current pattern's last alphabet is D. Or more simply, that rule applies if it follows the use of a diphthong.
   

   Each rule contains one or several entries that are the possible choices given by that rule.
   Each entry is associated with a weight, a minimum and one or more alphabets.
   A weight is the number of characters used by the entry.
   A minimum is the number of free characters needed to apply the entry.
   The alphabet(s) is(are) added to a pattern during its building process.
   For example, one entry of the D rule could be (2, 3, VC). This means that alphabets V and C will be added to the current pattern if the last pattern's alphabet is D and if there are at least 3 free characters left to build the password. The rule's application costs 2 characters.

If for a given data set the alphabet set and the rule set are coherent - verified by the generator - every possible pattern from that data set is generated.
Passwords are generated randomly from the patterns.

The generator computes for each pattern the number of possible choices for a password, which is the product of the cardinal number of each sequential alphabet that is used in that pattern.

For a given password length and for a given data set, if the rule set doesn't produce duplicates - which is the case for the rule sets used in this web site - the sum of each combination number of each pattern is the total possible choice for a password produced with that data set and that length.