Strong passwords, two-factor codes and shared secrets

Passwords, two-factor codes, recovery keys: each needs making well and keeping somewhere sensible. These tools make them with the browser’s cryptographic random number generator, never store them, and never put them in a link. Even so, use a device you trust when the secret matters.

Take care with secrets. This runs only in your browser: what you enter isn't uploaded, stored or put in a link, and the page is built so that it can't send it anywhere else. Your browser's extensions and other software on your device can still see what's on screen, so use a device you trust and real secrets only when you need to. Disconnecting from the internet once the page has loaded gives the most protection. Use is at your own risk: see the terms.

1. Make a strong password

In the Password Generator, a Passphrase of words of five or six words is strong and easy to type; Random characters suits a password manager. The entropy under each set says how many passwords those settings could make. To check one you made up yourself, type it in: Weak spots lists what would make it fall quickly, such as a common password with @ for a, a year, or a run of neighbouring keys.

2. Two-factor codes

When a site shows a QR code to set up an authenticator app, it usually offers a “setup key” too. Paste it into TOTP / HOTP Codes to see the codes it makes, or to check a code under Check a code when sign-in keeps failing. A device clock that’s wrong by more than 30 seconds is the usual cause.

3. Split a secret between people

For a master password or recovery key that nobody should hold alone, the Secret Splitter splits it into shares, any few of which recover it: five shares, any three needed, for example. Give each share to a different person. Show QR codes makes them easy to print and keep on paper.