Feature Request: Random Password Generator with more controls

ctaranto

I migrated to 1Password from KeePass. The Random Password generator in KeePass has all kinds of ways to control which symbols to include in the random password, unlike 1Password which is a binary on or off for all symbols.

Many websites restrict the symbols used in passwords, resulting in me backing down to only use alphanumeric characters.

I would like to see 1Password offer more control when enabling symbols.

---

1Password Version: Not Provided
Extension Version: 1.14
OS Version: Windows 10
Sync Type: Not Provided

Ben

Hi @ctaranto,

Thanks for the feedback on this. We have a feature request filed but haven't come up with anything more solid than that at this point. For the time being when you use the Password Generator from inside the 1Password mini menu it is possible to directly edit the password in the displayed text field. It comes with the benefit that when you either click copy or fill 1Password will make a record of the edited password rather than the one it generated. I don't think we're going to see these silly password restrictions on sites go away any time soon, so hopefully we can come up with a UI to accomplish this without making things overly complex.

Thanks.

Ben

ctaranto

Thanks for the quick response, Ben.

I have always found the KeePass password generator has the proper categories of special characters. I suppose the challenge is fitting these options on the current web UI. For now, I will hand modify generated passwords to remove unaccepted characters.

Thanks...

Ben

Thanks for sharing @ctaranto. I have to admit I cringe a fair bit when thinking about suggesting my mother use an interface like that. While it seems to cover most of the common options... it looks imposing and seems to have potential to scare people off from generating strong passwords. This is the struggle.

Ben

ctaranto

Yup. The interface is very techy.

Perhaps a slider of some sort that enables additional (more advanced) special characters as you slide it to the right, and below the slider, the potential characters enabled appear.

Just a thought.

Ben

That is certainly an idea. :) Thanks.

Ben

Unknown

This content has been removed.

jonathan_herdt

I would be happy with a whitelist for allowed special characters since that is what most sites come down to :)

Ben

@Bernfrin

I can appreciate your perspecitve but please understand ours: 1Password has a broad audience (that we are trying to broaden). Introducing new interfaces that are "slightly techy" put us further away from that goal. Everyone deserves to be secure online, not just those that are comfortable with an interface like the one posted above. There is a constant balancing act when designing an application with highly technical concepts to end users who may not be at all technical.

Ben

Ben

@jonathan_herdt

Indeed. Thanks for sharing. :)

Ben

artoor

Let me join a conversation guys...
I noticed there is a pretty convenient and not very complicated function presented here - https://1password.com/teams/ as for the password generator that I feel lack of in my trial for individuals. I mean in the screenshot team members seem to be able to decide not only how long the generated password will be but also how many digits and symbols it will include. 1Password4 let us doing so, what about 1P7 personal license/subscritopn?

gordcook

I'm going to express an opinion as a fellow former KeePass user. I'm considering keeping it around simply as a password generator. I can still copy/paste the generated password into 1Password for storage and likewise copy/paste it into the change password field on the destination website or application. Clearly, there's no need to use KeePass to store the new password, but it's a really powerful generator.

@Ben, how about a toggle in the settings to enable/disable the advanced password generator UI? Default the toggle to off so your mother (and mine) would get the comfortable user experience. But you still give folks like you and I the option to enable the more powerful variant, à la KeePass, if we so choose. Would the product team be more amenable to that sort of compromise?

gordcook

@Ben, I was looking at my weak/vulnerable passwords and many of them are numeric PINs. I can choose a PIN at human-random. :( I can roll a d10 as many times as needed. :) But I can't seem to find a way to disable alphabetic characters from 1Password's random password generator.

PINs are necessary for many voice mail passwords, debit/credit cards, phone support systems, etc. Would the product team be amenable to an "allow letters" checkbox that could be deselected for this purpose?

Otherwise, I'm gonna go find my dragon dice.

Ben

@artoor

Those are the options available in 1Password 7 for Mac regardless of licensing / subscription, standalone / membership. Other platforms or extensions may offer different options, though we are looking to standardize on a solution across all of our supported apps.

Ben

artoor

Thank you for your reply, glad it is taken under consideration :)

Ben

@gordcook

Otherwise, I'm gonna go find my dragon dice.

Hey, they might be worth finding anyway! :)

Would the product team be more amenable to that sort of compromise?

Our team is fairly resistant to checkboxes and preferences for reasons highlighted in a number of threads on this forum, but that may be something we can consider. Ideally we'd like to find a solution that doesn't require that, but that may end up being the only reasonable option.

I was looking at my weak/vulnerable passwords and many of them are numeric PINs. I can choose a PIN at human-random. :( I can roll a d10 as many times as needed. :) But I can't seem to find a way to disable alphabetic characters from 1Password's random password generator.

This may vary by platform but in 1Password 7 for Mac I can achieve this by setting the length of the password and the number of digits to the same value:

Ben

gordcook

@Ben,

The Windows version looks like this:

How about a new password-like field type called "PIN" that is concealable but only allows numeric sequences? The only control needed would be the length of the generated string. I could see an additional benefit in that it could reduce the amount of noise in WatchTower. I think most, if not all, 4-digit numbers are listed as "vulnerable". A "PIN" field would not necessarily be subject to evaluation by WatchTower, making it more possible to get a clean report.

Anyway, I won't bring this up again. I can use KeePass (or a number of websites) to roll generate random PINs. It's just more convenient to have it all in one tool.

Ben

@artoor

You're very welcome. :)

Ben

Ben

@gordcook

As I mentioned to artoor above we do certainly recognize the need to standardize things like this across platforms. It is unfortunate that this doesn't work the same way in both 1Password for Windows and 1Password for Mac.

A PIN field type is an interesting idea, but would require a fair amount of work (i.e. a coordinated effort across all of our supported platforms) and as such isn't likely to be a high development priority. As we move to a more centralized codebase with shared libraries hopefully things like that will become more feasible.

Ben