The password generator creates passwords nobody can guess. You find it in the sidebar, in the browser extension, in the apps and right in every password field.
Three kinds
| Kind | Example | For |
|---|---|---|
| Password | T7#qv!2mZ9@kLp4w | Websites that Passbox fills in. You never need to remember it. |
| Passphrase | anchor-cloud-stairs-coffee-moon | Anything you type yourself, for example a master password or Wi-Fi |
| PIN | 830517 | Devices and cards that allow only digits |
You set the length and character types. If you opened the generator from a password field, one click puts the suggestion into that field.
How long should a password be
For websites, 16 to 20 random characters are a good choice. Longer is better as long as the website allows it. A passphrase of five random words is strong and still easy to remember.
More important than length is that every password is used only once. The security check shows where that is not the case.
Email aliases
With an email alias, every website gets its own address that forwards to your inbox. If a website is breached, only the alias is affected, and you turn it off.
In the web app, the generator creates aliases with these services: SimpleLogin, addy.io, Fastmail Masked Email, DuckDuckGo Email Protection and Firefox Relay.
- Create an API key with your service.
- Choose Email alias in the generator and add the key. Passbox stores it as an encrypted item in your vault.
- Create an alias. The request goes straight from your device to the service, not through Passbox.
Some services do not accept requests from web pages. The generator then tells you, and it works in the browser extension or the desktop app.