Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What Mac OS tool do you use to generate random passwords for logins, and back them up (encrypted) in case your computer dies?

share|improve this question

closed as off-topic by random Aug 16 '14 at 23:11

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they become outdated quickly and attract opinion-based answers. Instead, describe your situation and the specific problem you're trying to solve. Share your research. Here are a few suggestions on how to properly ask this type of question." – random
If this question can be reworded to fit the rules in the help center, please edit the question.

I use this – Moab Jul 1 '11 at 22:41
Interesting resource. However, if you're concerned about security, one should avoid using an online tool to generate passwords. Even if you trust this site 100%, HTTPS isn't 100% safe, nor is DNS. Who knows, someone could poison DNS to take you to a replica of this page–complete with an SSL cert.–and be databasing all your input. For really secure passwords, use diceware: – mkoistinen Apr 2 '12 at 14:08
up vote 9 down vote accepted

Keychain Access has this capability built-in, and it comes with Mac OS X.

share|improve this answer
How do you back up passwords in Keychain Access? – Zachary Burt Jul 3 '11 at 6:15
It is one of the options for MobileMe–soon to be iCloud–which is handy, because it can sync all your passwords to your various devices. It is also backed-up with TimeMachine. If you want to back it up manually, see this: – mkoistinen Jul 3 '11 at 8:23
Apple has said “Syncing of Mac Dashboard widgets, keychains, Dock items, and System Preferences will not be part of iCloud, …” (see MobileMe transition and iCloud). – Chris Johnsen Jul 5 '11 at 3:58
@Zachary you don't need to store in keychain access. Generate a password from the helper window and copy it wherever you want. – Daniel Beck Jul 5 '11 at 5:07
@ZacharyBurt Open Keychain → ⌘N → (sheet opens up) → press the button with a key icon – user495470 Jul 5 '11 at 6:40

Normally I use pwgen from the command-line if I need a memorable password. I choose the most appealing password from the list, specify one argument for the length of the password and then modify to taste.

If it doesn't need to be memorable, I use the KeePassX password generator.

On the App Store there are a few free utilities to choose from, but I suspect it is pwgen under the hood in many cases.

share|improve this answer

I use LastPass -- it's not OS X specific and they have browser plugins for every major browser and platform. It can generate passwords for you for any scenario really: web apps, non-web apps, etc.

Your data is stored on the LastPass server as an encrypted blob. LastPass doesn't maintain a parallel private key to access this data. This is key (and big differentiating point with a service like Dropbox). LastPass, therefore, cannot access your password file blob. If you lose your password to LastPass, you lose your data stored there. That's a good thing. Your LastPass password should be something long, preferrably a sentence, with more than just alphanumerics in it.

The service is still, I believe conceptually, vulnerable to browser-side attacks because decryption of your blob is done in the browser plugin. But this isn't any different from the way KeyChain data or even data encrypted with something like PGP is handled: at some point you have to decrypt to use the data and the best, safest place to do that is local to the machine you're working on just in time to access the data. That's, more or less, how LastPass architects it.

share|improve this answer

I use a password matrix. Basically, I have a business card that I keep in my wallet that contains a 10 x 10 matrix of random letters, cases, numbers and symbols. I keep one copy of this stored on my email and another on my computer. Depending on the level of sensitivity of information that I'm looking to protect, I'll use a different algorithm. So all you have to remember is your algorithms.

Something that you don't care about could just be the first row for your password.

Something a little sensitive could be the first 1,1 2,2-2,9 1,10

Something very secure could be two rows, first even columns and the second the odd columns.

Basically the whole concept is that you're flaunting your passwords around, but it's completely useless unless you know what the algorithm used is.

After time, you'll have it all memorized.

share|improve this answer
1… – kobaltz Jul 1 '11 at 22:59

I use the Password Assistant that comes up when you click the little key next to the new password field in the change account password section of System Preferences (it looks relatively standalone, but I've not found a more convenient way to invoke it without pretending to change my password, then cancelling). I find the "memorable" setting produces passwords that are fairly secure and, well, memorable. My one complaint is that it could be a bit more liberal with the capital letters.

To store passwords, I have a copy of 1Password on my iPhone. I picked it up for free (or at least very cheap) on a special offer; I'm not sure I'd pay the £6 they want for it at them moment, and I certainly don't have the desktop app for syncing or anything. It does, however, get backed up with everything else on my phone when I sync through iTunes.

share|improve this answer
You can get to it in Keychain Access, as mkoistinen mentioned. – William Jackson Jul 2 '11 at 3:21

I use the !password feature of DuckDuckGo.

Just type !password in the search box and it will return a random 8-digit password for you. If you want a password of a different length, just include it as an argument, e.g., !password 16.

share|improve this answer
As mkoistinen pointed out above, an offline version is probably better. Even if this is generated in Javascript, it is relatively easy for the password to be sent somewhere. – Tim Aug 31 '12 at 8:59

Not the answer you're looking for? Browse other questions tagged .