ISiso1631·Nov 17, 2021
My word list contains 7227 words apparently, so 12.82 bits per word
https://github.com/redacted/XKCD-password-generator
Not sure how many bits a "good" password should be nowadays.
In I hate password rulesredacted
XKCD-password-generator
Python2012–2021
redacted / XKCD-password-generator
XKCD-password-generator
Generate secure multiword passwords/passphrases, inspired by XKCD
6Distinct people
7Mentions
0Explicit recommenders
1.4KGitHub stars
What to know before exploring
What it is
Generate secure multiword passwords/passphrases, inspired by XKCD
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year7 dated mentions
Observed mentions: 2012-06-03 22:06:35 UTC to 2021-11-17 13:47:59 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
7 sources> I should probably just figure out how to write a keepass plugin
KeepassXC already has this feature [1][2]. It can also store and generate OTP codes and works with YubiKeys (similar to Bitwarden Premium).
There's also a popular Python script called xkcdpass [3] which does the same from the command-line.
[1] https://keepassxc.org/images/screenshots/windows/screen_006....
[2] https://keepassxc.org/
[3] https://github.com/redacted/XKCD-password-generator
In Your Mother’s Maiden Name Is Not a SecretWhat we should really talk about is the password entropy like what you've done.
If you take the xkcdpass package from Ubuntu, it uses a word list of 41230 words by default [1]. That's 41230^4 and about 61-bit of password entropy. If you want to use a smaller word list, add words to the passphrase until you reach a desirable password entropy.
Using your example of 80^7 for random characters, that's only 44-bit password entropy. So in this case, xkcdpass gives you a stronger password with just 4 words. If you want to reduce the word list to 3000, just add 1 more word and it's 46-bit password entropy. A decision between 7 random characters vs 5 words.
I personally prefer random characters because you can up the entropy significantly, and I have no problem remembering random sequence in the mid-teens range. That can easily get you 90-bit entr
Read the rest
opy or more. Everything else is saved in my password manager and there you can up the entropy even more. My auto-generated passwords are usually around 200-bit entropy.
[1]: https://github.com/redacted/XKCD-password-generator
XKCD-proposal-based password generator
3 points · Open discussionShameless self-promotion https://github.com/redacted/XKCD-password-generator
In The Worst Password TipsIf you're having problems thinking of a good passphrase, there's https://www.xkpasswd.net, but if you're uncomfortable with doing that in-browser, there's a bash one-liner[0] and a Python program[1] that do the job well.
[0]: echo $(grep "^[^']\{3,5\}$" /usr/share/dict/words|shuf -n4) # Try different dictionary files if you want a less complex passphrase.
[1]: https://github.com/redacted/XKCD-password-generator
In Show HN: How secure is your passphrase?I wrote a small script to generate passwords after reading that comic [1]. Using a good wordlist one can easily produce memorable and secure passwords.
Unfortunately, many sites enforce rules that preclude this password style (e.g., must contain a number).
[1] https://github.com/redacted/XKCD-password-generator/
In Password Rules