Pafwert - a tool for smarter passwords

[webfork]

A potentially better password generator: https://xato.net/windows-security/pafwe ... -z0sv1R-So ... even talks about password generation being "fun" which is a novel concept. It's a cool idea and many of the passwords suggested are very memorable.

Their synopsis:

Pafwert is an unique tool to help you to select strong passwords that are easy to remember. Pafwert suggests sample passwords that you can use to formulate a strong password that works for you. Using strong entropy, tens of thousands of seed words, more than a hundred patterns with endless variations, and following password best practices, Pafwert can help you to select very strong passwords that are surprisingly easy to memorize. We have all seen random password generators, but Pafwert is surprisingly different.

License: non-commercial use. There's something up on github (https://github.com/m8urnett/pafwert) but I can't tell what open source license it uses, if any.

Status: Portable

Settings: None. You can tweak some of the passwords by modifying the Settings registry key below or the Patterns.cfg file.

Stealth: No: writes to HKLM\Software\Pafwert\Settings. I *think* it writes to HKLM\SOFTWARE\Classes\CLSID\ but I couldn't be sure. That might have been another program.

Homepage: https://xato.net/windows-security/pafwe ... -passwords

Softpedia Screenshots: http://www.softpedia.com/progScreenshot ... 64240.html

Steps:

1. Download and extract the zip file
2. Use Uniextract (7-zip works too) to extract the install file Pafwert_v1.5.personal.msi
3. Run Pafwert.exe

[freakazoid]

The algorithm is basically using Diceware, which creates an easier-to-remember passphrase.

I've been converting my older passwords over to Diceware passphrases. The problem is still remembering all these different passphrases per account and typing in the longer password (yeah I know, use a password maanger).

[webfork]

The problem is still remembering all these different passphrases per account and typing in the longer password (yeah I know, use a password maanger).

I don't really trust a password manager so over time I've developed a "hint" system. It's not foolproof either as someone might guess the hints and I've forgotten what some of the older hints mean, but I guess the assumption there is that if it's that old and I haven't used it in long enough, maybe it's okay

[freakazoid]

I don't really trust a password manager

Totally agree!

[Midas]

Do you know anything I don't about KeePass, for example? Never saw anyone dissing it, plus it has served me well for many years (and it's available in Android/Linux, too)...

[webfork]

Do you know anything I don't about KeePass, for example?

I have a problem with one master password holding access to all my other passwords. That's just one layer of security and can be cracked with a simple keylogger. There are other issues, such as plausible deniability and that's harder to put across if you're claiming not to remember the ONE password the rest of your machine is using to connect.

[SYSTEM]

I have a problem with one master password holding access to all my other passwords. That's just one layer of security and can be cracked with a simple keylogger.

The master password alone is useless for an attacker. He/she also needs your password database.

[Midas]

The master password alone is useless for an attacker. He/she also needs your password database.

Plus one can also (and/or/xor) set an additional keyfile -- something that you carry with you all the time, in your pendrive, for example...

[webfork]

A similar program: L517 word list generator could be used for a similar purpose to Pafwert.

https://www.portablefreeware.com/forums ... 20&t=16909

[Midas]

License: non-commercial use. There's something up on github (https://github.com/m8urnett/pafwert) but I can't tell what open source license it uses, if any.

Pafwert is now open source and available at GitHub.

The developer avows that development has stopped in 2009. Apparently, you can find the source -- including Windows binaries(*), contrary to what is stated further down on that page -- at https://github.com/m8urnett/pafwert...

FYI, the original Wordpress homepage/blog has been moved to Medium.com, so most links from https://xato.net/ are currently broken.

(*) Look inside the "Build/Pro" folder.