Webful PasswordMaker

An app.

Makes secure, unique-per-site passwords.

Uses this established, portable protocol.

Works offline. No central database to get hacked. Good for these reasons.

Free. Open source. Available now.

Beta versions

By getting the next version of the app early, you can help make it better.

You'll get all the latest features. And all the latest bugs. :)

Opt in for Android here or iOS here.

Getting Your Settings Right

You should check out the Settings before using the app for all your passwords, as it's a bit messy to change them later.

Here's what they do:

• Length of passwords – How long the output passwords should be for each site – not including the extra fixed number if you enable that setting. The default is 15 because unfortunately a few sites limit passwords' length to 15 or 16 characters – some even cap them at 12. (You should probably complain to the owners of any sites with this kind of upper limit, as it weakens your security and theirs.) The longer you make the output, the stronger your passwords will be but the more sites will ask you to trim them down. Depending on your appetite for convenience vs. security, lengths of 20 or even higher may be worth considering, but keep in mind you may have to manually shorten the results for some sites.
• Possible characters – Another trade-off. The default is Alphanumeric because quite a few sites unfortunately disallow some symbols that can be included when you pick Alphanum + symbols. As with higher lengths, adding in symbols makes things more secure but less compatible.
• Minutes to remember master password – This doesn't affect your passwords, just how the app behaves on your phone. If you set it to 0 we'll try to clear it once it looks like you're done with the Make a Password screen, but you should still be careful and lock & encrypt your phone for maximum security.
• Hash algorithm – This one's pretty complicated. If you haven't used a different choice with another extension or app already, probably stick with the default.
• Add a fixed number? – This is a quick shortcut to help you out when sites require a number in your password. It doesn't really make things more secure, but helps you meet that criterion by sticking the exact same digit onto the end of each password. You can use Password Suffix to get the same effect in some browser extensions and other apps.
• Use just domain name? – Only turn this off if you are using the app in an unusual way or need every page to have its own different password, even on the same site. For most people this should stay on. You'll see a warning on the Make a Password screen if you turn it off.

What's Advanced Mode?

The Enabled Advanced Settings button at the bottom of Settings gives you extra control over your password generation, but also makes the app more complicated.

Because it adds rules that can't work in the simpler, default mode, the change is permanent, so you should review this section and see if you'll use the extra features before you switch.

When you opt in

You won't lose your existing settings if you saved them before. The app will migrate your existing settings to an initial Profile. You'll see that most settings no longer live on the main Settings page, and can instead be managed by opening the Default Profile.

Profiles

The most noticeable difference in Advanced mode is that you can have multiple independent password profiles. For example, you could have one set of rules for Sites requiring numbers or one for Ticketing.

You can rename or change your Default profile and add more. Once you have other Profiles you can delete the original Default too.

You can see and choose which Profile is in use each time you generate a password from the app's main screen.

Additional generate options

Advanced mode also adds most options you may see in other PasswordMaker protocol extensions and apps. Username & modifier are folded into a single option as explained on the Profile edit page. If you'd like more explanation of an Advanced setting here, please email passwordmaker@webful.uk.

What About Desktop?

Because the Webful app follows the existing PasswordMaker protocol, you've got options outside the mobile world too, including desktop browser extensions for Firefox and Chrome. There will probably be a web version of the app soon too, similar to this but with the modern interface of the Webful mobile app.

Privacy

The PasswordMaker app sends no data to our servers, or anyone else's, except as required by your phone vendor and to attempt to* move your preferences (not any passwords) if you change device.

As the password making is deterministic we don't actually need a server, so nothing sensitive leaves your phone.

There are no accounts and nothing tracking your usage.

*This is a new feature, no promises

Feedback

I'd love to hear your thoughts! Please email passwordmaker@webful.uk