Customize Securely Generated Password

[alexj]

Hi

Strong random password generation suggestions has been an awesome feature introduced in Firefox.

Unfortunately I almost never use it because the suggestions are not strong enough by my security standards. From what I've seen Firefox suggests 15 alphanumerical passwords whereas my passwords are usuall 32 or 64 char (with special characters) unless the site doesn't allow it.

So I always need to fallback to "pwgen -nsy 32" or similar. It would be great to be able to customize it.

I looked several times in about:config for a way to do it, but either didn't find it (neither in documentation) or the feature doesn't exist.

Thus my proposal is: allow for customization in about:config for strength of suggested passwords.

Bonus: suggest several passwords, not just one (suggest one that has special characters and long, one just long, another short etc.) This was it will allow for options when picking a "strong" password for a specific site.

Bigger bonus: have a way of scraping the website and detecting the password limits and generate the strongest passwords that the specific sites allows.

Thanks

[Jon]

Thanks for submitting an idea to the Mozilla Connect community! Your idea is now open to votes (aka kudos) and comments.

[Wallakh]

I'd like to see stronger passwords also, I only use Firefox for my passwords

[Serg]

Thanks @alexj ! Indeed we should think of giving more control to users who wants stronger passwords. There is Bug 1650312 where we track this request.

[stoxford]

I, too, would like the ability to control the minimum entropy of auto-generated passwords. I don't use Firefox's password generation feature because the passwords are too weak.

I would like random passwords with at least 128 bits of entropy. By my calculations, that would be 22 characters long if the character set consists of lowercase letters, capital letters, and numbers. For some accounts I prefer 256 bits of entropy, which requires 43 random characters.

32-character (128 bit) or 64-character (256 bit) random hexadecimal passwords could be easy for users to manually type on mobile, even though they use more characters, because users wouldn't need to keep hitting the shift key.

[DiscoM]

In 2024 now, Firefox give no options for generated password.

50% of the time the parameters for the website's requirement are not OK, so you need to edit it by hand, sometimes without seeing what you are doing because the field is password type.

Most simple users do not understand why it's not working and experienced users are annoyed by the behavior.

[odelrieu-syn]

Just bumped into this problem when trying to generate a password for AWS. I am looking for about:config parameters to make these generated password adequate. Ending-up copy/pasting from https://passwordsgenerator.net/

[Firefoxenjoyer3]

I believe improving the Firefox password generator is valuable. However, we must keep in mind that many websites have specific password length and character requirements. Making passwords longer by default may frustrate users who are unaware of these standards, as they would need to manually shorten the password.

As a result, I recommend that users be given the option to enable this feature in their settings. This option would allow users to specify the length of the passwords generated and select which special characters and symbols to include.

[alexj]

@Firefoxenjoyer3I am not advocating for changing the default. Agree with your statement about most users.

But for the users that do want to do this, there should be the option. Firefox has always had customization as  big selling point so I am surprised this wasn't a thing from the start. But I would be one of the users that would go into settings and make that change.