DEV Community: Kokal Limited

Are Browser Password Managers Safe in 2026?

Kokal Limited — Tue, 25 Aug 2026 05:19:07 +0000

Failed to authenticate. API Error: 401 OAuth access token has been revoked.

BestPasswordGenerator.org vs SecureKeyGenerator.com: Which Free Generator Should You Use in 2026?

Kokal Limited — Sun, 23 Aug 2026 05:18:55 +0000

Failed to authenticate. API Error: 401 OAuth access token has been revoked.

Strong Password Generators: What Actually Makes a Password Secure?

Kokal Limited — Tue, 11 Aug 2026 05:18:51 +0000

Most people have already been breached and don't know it. The 2023 Verizon DBIR found that 86% of data breaches involve stolen or weak credentials — making password hygiene the single highest-leverage security improvement most users can make.

And yet "P@ssw0rd1!" still passes most strength checkers. Here's what actually matters.

The Core Problem: Human Bias

Humans are terrible at generating random strings. We pick patterns, keyboard walks, and dictionary words with symbols bolted on. A proper strong password generator removes that bias entirely by using a Cryptographically Secure Pseudorandom Number Generator (CSPRNG).

In the browser, that means the Web Crypto API:

function generatePassword(length = 16, charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*') {
  const array = new Uint32Array(length);
  window.crypto.getRandomValues(array);
  return Array.from(array, n => charset[n % charset.length]).join('');
}

This draws entropy from the OS random pool — the same source used in TLS key generation. Crucially, each character is statistically independent of the last, which is what makes the output unpredictable. Contrast this with Math.random(), which is seeded and deterministic — never use it for security-sensitive output.

Length Beats Complexity Every Time

This is the result most people find counterintuitive. Here's estimated brute-force cracking time against a modern GPU cluster at 10B guesses/sec (via Hive Systems 2024):

Length	Character Set	Est. Crack Time
8	Lowercase only	< 1 minute
8	Full mixed	8 hours
12	Full mixed	3,000 years
16	Full mixed	1 billion years
20	Full mixed	Practically infinite

A 12-character fully mixed password is already strong by any practical measure. At 16+ characters, you're in "heat death of the universe" territory.

What a Trustworthy Generator Looks Like

When evaluating or building one, check for:

Client-side only — no password is transmitted over a network
CSPRNG — window.crypto.getRandomValues() in browsers, secrets module in Python, crypto/rand in Go
Configurable — length and character set should be user-controlled
No logging — the output is never stored or cached

import secrets, string

def generate_password(length=16):
    alphabet = string.ascii_letters + string.digits + string.punctuation
    return ''.join(secrets.choice(alphabet) for _ in range(length))

The Takeaway

Stop optimizing for "looks complex." Optimize for length and genuine randomness. A 16-character password from a CSPRNG-backed generator is astronomically harder to crack than any 8-character pattern a human would invent — no matter how many ! symbols you add.

Use a password manager, generate 16+ character passwords for everything, and let the entropy do its job.

Originally published on StrongPassFactory

What Makes a Password Actually Good (A Developer's Guide to Entropy)

Kokal Limited — Sun, 09 Aug 2026 13:26:55 +0000

We've all built a signup form and slapped a regex on the password field: "at least 8 characters, one uppercase, one number, one symbol." It feels rigorous. It's mostly theater.

The problem is that complexity rules optimize for the wrong thing. P@ssw0rd! satisfies every checkbox above and is one of the first strings any cracking dictionary tries. What actually matters is entropy — the number of guesses an attacker needs on average.

Entropy, briefly

Entropy scales with the size of the character pool and the length of the password:

bits = length × log2(pool_size)

A 8-character password from the full ASCII printable set (~95 chars) gives you:

8 × log2(95) ≈ 52 bits

A 16-character lowercase-only passphrase (correcthorsebatterystaple-style)?

16 × log2(26) ≈ 75 bits

Longer-but-simpler beats shorter-but-gnarly. Every character you add multiplies the search space; every extra symbol class only adds a bit or two. This is why length is the single highest-leverage variable.

What "good" actually means

High entropy — aim for 70+ bits for anything that matters. That's roughly 12+ random characters or 5+ random words.
Truly random — generated by a CSPRNG, not picked by a human. Humans cluster around dates, keyboard walks, and l33t substitutions that crackers model well.
Unique per site — reuse turns one breach into many. This is non-negotiable, which is why a password manager isn't optional.

Generate them right

Don't hand-roll Math.random() — it isn't cryptographically secure. Use your platform's CSPRNG:

// Node.js
const { randomInt } = require('crypto');

const CHARS = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*';
const generate = (len = 20) =>
  Array.from({ length: len }, () => CHARS[randomInt(CHARS.length)]).join('');

console.log(generate()); // e.g. "kR8$mZ2!qWfN...@vT4"

For a memorable-but-strong passphrase, pull random words from a wordlist (Diceware-style) using the same CSPRNG.

The takeaway

Stop enforcing symbol soup on your users. Set a generous minimum length, encourage a password manager, check submissions against known-breach lists (the HaveIBeenPwned range API is free and k-anonymized), and let entropy do the heavy lifting.

Good passwords aren't clever. They're long, random, and unique — and ideally you never see them, because a generator made them for you.

Originally published on strongpassfactory.com

How to Create a Secure Password: A 7-Step Guide for Developers

Kokal Limited — Fri, 07 Aug 2026 13:19:31 +0000

Weak credentials are still one of the easiest ways into a company's systems. If you write auth code, ship apps, or just want to stop reusing the same password everywhere, here's a practical 7-step approach to building passwords that actually hold up.

1. Go long before you go complex

Length beats complexity. Entropy scales with length, so a 20-character passphrase crushes an 8-character string of symbols. Aim for 16+ characters minimum.

# Weak (short, predictable substitutions)
P@ssw0rd!

# Strong (long passphrase)
correct-horse-battery-staple-42-quartz

2. Use a generator, not your brain

Humans are terrible entropy sources. Let the machine do it:

# 32-char random password from the CLI
openssl rand -base64 24

# Or with Python
python3 -c "import secrets; print(secrets.token_urlsafe(24))"

Use secrets, never random — the latter isn't cryptographically secure.

3. One password per account

Credential stuffing works because people reuse passwords. A breach at one service becomes a master key everywhere else. Unique credentials contain the blast radius to a single account.

4. Store them in a password manager

You can't memorize 100 unique 32-character strings, and you shouldn't try. A password manager (Bitwarden, 1Password, KeePassXC) encrypts everything behind one strong master password. For teams, this is non-negotiable.

5. Turn on 2FA — prefer hardware keys

A password is one factor. Add a second:

Best: hardware security key (FIDO2/WebAuthn) — phishing-resistant by design
Good: TOTP authenticator app
Avoid: SMS codes (SIM-swappable)

If you're building auth, support WebAuthn. It kills phishing in a way OTPs can't.

6. Never hardcode or commit secrets

The strongest password is worthless in a public repo. Keep credentials out of source:

# .env — and add it to .gitignore
DB_PASSWORD=<generated-secret>

# Scan before you push
git secrets --scan

Use a vault (HashiCorp Vault, AWS Secrets Manager) for anything production.

7. Rotate on compromise, not on a calendar

Forced 90-day rotation trains users to pick weak, incremental passwords (Spring2026! → Summer2026!). Modern guidance (NIST SP 800-63B) says: rotate when there's evidence of compromise, and monitor breach databases like Have I Been Pwned instead.

Strong passwords aren't about clever symbol swaps — they're about length, uniqueness, good storage, and a second factor. Bake these defaults into your projects and your users inherit the security for free.

Originally published on strongpassfactory.com

Password Apps Every Small Business Needs in 2026

Kokal Limited — Wed, 05 Aug 2026 13:19:31 +0000

If you ship software for a living, you already know the drill: the weakest link in your security isn't your code, it's the admin/admin123 login someone on the ops team is still using in production. For small businesses without a dedicated security team, the right password tooling is the cheapest insurance you can buy.

Here's a developer-friendly breakdown of what actually matters in 2026.

1. A team password manager (non-negotiable)

Bitwarden, 1Password, and Vaultwarden (self-hosted) all support CLI access, which is what makes them worth it for devs. You can pull secrets into scripts without hardcoding them:

# Fetch a secret at runtime instead of committing it
export DB_PASSWORD=$(bw get password "prod-postgres")
psql -h db.internal -U app

No more .env files floating around Slack.

2. A password generator with real entropy

Skip the "correct horse battery staple" jokes and generate high-entropy secrets programmatically:

# 32-char password, URL-safe
openssl rand -base64 24

# Or with Python
python3 -c "import secrets; print(secrets.token_urlsafe(32))"

For non-technical teammates, a hosted generator works fine — just make sure it runs client-side and never transmits the output.

3. Hardware keys for anything that matters

Software 2FA is good; phishing-resistant hardware 2FA is better. A YubiKey 5 NFC or a FIDO2-certified security key stops credential-stuffing attacks cold because the auth is bound to the origin. If an attacker phishes the token, it's useless on their fake domain.

For SSH, you can back your keys with a resident FIDO2 credential:

ssh-keygen -t ed25519-sk -O resident -O verify-required

Now your private key literally cannot be exfiltrated from the laptop — it lives on the hardware.

4. Secret scanning in CI

Password hygiene isn't just storage — it's catching leaks before they merge. Add a scanner to your pipeline:

# .github/workflows/scan.yml
- name: Scan for secrets
  uses: gitleaks/gitleaks-action@v2

The short version

Need	Tool type
Shared credentials	Team password manager (CLI-capable)
Strong secrets	`openssl` / `secrets` / hosted generator
Phishing-proof 2FA	FIDO2 hardware key
Leak prevention	CI secret scanning

You don't need an enterprise budget to get 90% of the protection an enterprise has. You need a manager, a generator, a hardware key, and a scanner in CI — most of which are free or under $50.

Lock it down before someone else does it for you.

Originally published on StrongPassFactory.

How to Change a Password Correctly: A Developer's Guide for Small Teams

Kokal Limited — Fri, 31 Jul 2026 14:38:45 +0000

Changing a password sounds trivial—click "forgot password," type a new one, done. But if you run infrastructure for a small business or team, doing it correctly matters more than doing it fast. A sloppy password rotation can lock out services, break automation, or leave old credentials floating around in logs and config files.

Here's how to do it right.

1. Don't Just Change It—Rotate It

A password change should assume the old one is already compromised. That means:

Invalidate active sessions after the change
Revoke API tokens or app passwords tied to the old credential
Check for the password hardcoded in scripts, .env files, or CI secrets

# Quick sweep for a leaked password string in your repo
grep -rn "OldP@ssw0rd" . --include="*.env" --include="*.yml"

If it shows up anywhere in version control, rotating the password isn't enough—you'll want to scrub the history too.

2. Generate, Don't Invent

Humans are bad at randomness. Let a tool do it:

# 20-char high-entropy password
openssl rand -base64 20

# Or with a password manager CLI
op item create --category=login --generate-password='letters,digits,symbols,32'

Aim for length over complexity. A 20+ character random string beats P@ssw0rd! every time.

3. Update Everywhere It Lives

The most common failure isn't a weak password—it's a stale one. When you rotate a shared credential, update:

The password manager (single source of truth)
CI/CD secrets and environment variables
Any service accounts or cron jobs that authenticate with it

4. Enforce It as Policy

For a small team, tooling beats memory. Push everyone onto a shared password manager, require MFA, and stop forcing arbitrary 90-day resets—NIST guidance now recommends changing passwords only when there's evidence of compromise, not on a fixed timer.

Bottom Line

A correct password change is a small workflow: rotate the assumption of compromise, generate high entropy, propagate everywhere, and back it with MFA. Do that consistently and password hygiene stops being a fire drill.

Originally published on strongpassfactory.com

Building a Password Policy for a Small Dev Team (2026 Edition)

Kokal Limited — Wed, 29 Jul 2026 13:18:51 +0000

You've got five people. Nobody owns "IT." One dev still uses Password1! for the CRM, and someone shared a login with a contractor over email last week. Your whole stack sits behind the weakest credential on the team.

Small teams face enterprise-grade threats on a hobbyist budget. The Verizon 2026 DBIR found that 43% of cyberattacks target small businesses, and stolen credentials are still the top attack vector (53% of breaches). For teams of 10 or fewer, IBM puts the average credential-breach cost at $98,000. A written, followed password policy is the cheapest defense you have.

What the policy actually needs

Here's the 2026 baseline vs. what you should ship:

Requirement	Old minimum	2026 recommendation
Length	8 chars	12+ chars (NIST SP 800-63B)
Complexity	Mixed types	Drop composition rules — favor length
MFA	Optional	Mandatory, all accounts
Expiry	Every 90 days	Only on known compromise
Password manager	Optional	Mandatory, company-wide
Breach checks	None	Auto-check against HIBP
Shared creds	Allowed	Forbidden — use secure sharing

Both NIST and NCSC dropped mandatory periodic rotation. A 15-character passphrase beats a P@ssw0rd! that ends up on a sticky note.

Pick your infrastructure first

Tools before rules. For a small team that means a shared password manager + MFA everywhere.

Password manager: Bitwarden Teams or 1Password Business, ~$3–4/user/month. Shared vaults, secure sharing, breach monitoring. Keeper Business is worth a look if you're under HIPAA/PCI-DSS/ISO 27001.
MFA: Non-negotiable on anything internet-facing. Google/Microsoft Authenticator are free; Duo has a free tier up to 10 users with wide app integration.

Enforce it in code, not vibes

Don't just write "12+ characters" in a wiki — validate it. A quick example:

import re, hashlib, requests

def is_strong(pw: str) -> bool:
    return len(pw) >= 12

def is_pwned(pw: str) -> bool:
    sha = hashlib.sha1(pw.encode()).hexdigest().upper()
    prefix, suffix = sha[:5], sha[5:]
    res = requests.get(f"https://api.pwnedpasswords.com/range/{prefix}")
    return any(line.split(":")[0] == suffix for line in res.text.splitlines())

The HIBP range API uses k-anonymity — you only send the first 5 hash chars, never the password. Wire this into signup and password-reset flows so weak or breached credentials never make it in.

The rules employees actually follow

12+ characters, generated by the manager (nobody memorizes them)
MFA on every account, no exceptions
No shared logins — use the vault's sharing feature
Rotate only on a known breach
Run quarterly audits and a short onboarding walkthrough

A policy is only as good as its enforcement. Automate the checks, make the secure path the easy path, and revisit it every quarter.

Originally published on strongpassfactory.com

What Devs Should Learn From the Dashlane Brute-Force Attack

Kokal Limited — Wed, 29 Jul 2026 13:03:14 +0000

On May 31, 2026, Dashlane got hit with a coordinated brute-force attack that locked thousands of users — including team-plan customers — out of their vaults during work hours. Dashlane confirmed to BleepingComputer that automated controls suspended targeted accounts. No internal systems were breached, and accounts were restored. But if your team depends on a password manager, this is worth a look.

The actual attack vector: credential stuffing

The attack wasn't some exotic zero-day. It was credential stuffing — replaying leaked email/password pairs against a high-value login endpoint. It works because of one stubborn human habit: password reuse.

Attackers pull credential pairs from breach dumps and script them against a target:

# Conceptually, what an attacker's loop looks like
for email, password in leaked_credentials:
    r = session.post("https://vault.example.com/login",
                     data={"email": email, "password": password})
    if r.status_code == 200:
        log_hit(email)  # reused password → account compromised

Per Verizon's 2024 DBIR, 43% of cyberattacks target small businesses, and only 14% are prepared. A locked password manager isn't a minor annoyance — it means no access to shared vaults, client creds, or infra secrets mid-incident.

Defense: what you can actually configure

If you administer a team plan, MFA enforcement is the single highest-leverage control. Credential stuffing dies instantly when a second factor is required:

# The policy posture you want on any team password manager
mfa:
  enforcement: required      # not "optional"
  methods: [totp, webauthn]  # prefer hardware/WebAuthn over SMS
lockout:
  policy: admin-configurable # not vendor-locked
  admin_override: true       # someone can unlock a locked-out director
audit_logging: full

Consumer plans give you vendor-defined lockout and optional MFA. Business tiers (1Password Teams, Keeper Business, LastPass Business) let you mandate MFA, configure lockout, and unlock accounts as an admin.

A short checklist for engineers

Enforce MFA — prefer WebAuthn/TOTP over SMS. This alone neutralizes credential stuffing.
Document recovery — designate a backup admin who can override lockouts. Don't let one locked account halt the team.
Audit reused passwords — run your team through Have I Been Pwned or your manager's built-in breach report.
Rate-limit your own login endpoints — if you ship auth, the same attack applies to you.

The uncomfortable takeaway: even a well-built password manager can be knocked offline by attackers weaponizing your users' reused passwords. MFA and a documented recovery path are what keep a Tuesday-morning attack from becoming a Tuesday-morning outage.

Originally published on StrongPassFactory.

The 10-Minute Offboarding Checklist Every Dev Team Ignores

Kokal Limited — Mon, 27 Jul 2026 13:09:17 +0000

When an employee leaves, how fast can you kill their access? If it's not "under 10 minutes," you have a problem.

In our analysis of SMB security incidents this year, failure to revoke former-employee access was the root cause of 34% of preventable breaches — more than phishing, more than weak passwords. The Verizon 2026 DBIR pegs 28% of breaches on internal actors, and ex-employees with live credentials are a big slice of that.

These failures are quiet and boring. No zero-day, no APT — just a token nobody rotated. Which is exactly why they're so preventable.

Why it breaks in small teams

Enterprises wire HRIS into their IdP, so termination auto-deactivates accounts. Most of us run manual processes that fall apart under pressure:

No account inventory — 20+ SaaS subscriptions and nobody knows who has access to what.
SSO blind spots — you kill the IdP, but they signed up for three tools directly with a personal-looking email, bypassing SSO entirely.
Shared vault chaos — if they owned the team password vault, revoking them can lock everyone out.
API keys and PATs — the scariest one for devs. Personal access tokens keep working long after the human is gone.

The NCSC measures the risk window in hours, not days.

The core checklist

Run these in order, starting the minute notice is given:

# 1. Disable the identity provider account first (Entra ID / Google Workspace / Okta)
# 2. Revoke ALL active sessions — invalidate live tokens, don't just reset the password
gcloud identity ... # or your IdP's "sign out everywhere"

# 3. Rotate the shared vault master + any secrets they could read
# 4. Remove from every SaaS app individually (CRM, billing, PM, email)

# 5. Kill API keys and personal access tokens — check every provider
gh auth status              # audit GitHub PATs
aws iam list-access-keys --user-name former.employee

Passwords are polite; session and token revocation is what actually locks the door. A disabled account with a live OAuth token is still an open door.

Automate what you can. Even a simple runbook — a checklist in your wiki with owners assigned per step — beats scrambling under emotional pressure the day someone gets walked out.

The goal isn't enterprise tooling. It's a repeatable process you can run in 10 minutes, every single time.

Originally published on strongpassfactory.com.

Insider Threat Detection: SMB Password Policies That Actually Work

Kokal Limited — Sat, 25 Jul 2026 13:05:33 +0000

When we think about security threats, we default to the external attacker — ransomware, phishing, brute-force bots. But according to the Verizon 2025 DBIR, insider threats account for 34% of breaches in small and medium businesses. And the top attack vector? Abused or mismanaged passwords.

The good news: you don't need a SOC to defend against this. You need sane password policies and a few controls wired into your credential workflow.

The three kinds of insider

Not every insider is malicious. Knowing the category tells you which control to reach for:

Malicious — departing staff or contractors intentionally misusing access (exfiltrating a customer DB before resignation). IBM pegs the average cost at ~£210k per incident.
Negligent — well-meaning people bypassing policy for convenience: passwords in Slack, credentials in a shared spreadsheet, no logout on shared machines. This is the biggest bucket — 56% of insider incidents.
Compromised — an attacker operating under a real employee's stolen identity. NCSC attributes 72% of detected UK SMB insider incidents to compromised credentials.

Controls that map to real attack patterns

1. Just-in-time (JIT) privileged access. Stop granting permanent admin. Issue elevated credentials that expire on a timer.

# Example: time-boxed elevation policy
grant:
  role: db-admin
  user: alice@company.com
  ttl: 30m          # auto-revoke after 30 minutes
  approval: required
  audit: true

2. Credential check-in / check-out. Shared accounts (vendor portals, social logins, admin consoles) should live in a vault that logs access and blocks concurrent use.

[vault] alice checked OUT vendor-portal @ 14:02
[vault] bob requested vendor-portal → QUEUED (in use)
[vault] alice checked IN vendor-portal  @ 14:19

3. Automated offboarding. Every departure should trigger a revocation workflow — rotate any shared secrets the person touched, kill their sessions, and confirm.

# Offboarding hook (pseudo)
revoke_sessions "$USER"
rotate_shared_secrets --touched-by "$USER"
disable_sso "$USER" && notify_admin "offboarded: $USER"

Why this works

None of these require expensive tooling — most business password managers support JIT and check-in/check-out out of the box. The pattern is the same each time: short-lived credentials, logged access, and automatic revocation. You reduce the blast radius of a malicious insider, remove the shortcuts a negligent one relies on, and shrink the window a compromised account stays useful.

Start with a baseline password policy, layer these three controls on top, and you've covered the vast majority of insider-driven breaches without hiring a security team.

Originally published on strongpassfactory.com

MFA for SMBs in 2026: A Developer's Quick-Start Guide

Kokal Limited — Thu, 23 Jul 2026 13:03:26 +0000

If you build or maintain systems for a small business, multi-factor authentication (MFA) is the single highest-leverage security control you can ship. The Verizon 2026 DBIR found that 81% of breaches involve stolen or weak passwords — and MFA neutralizes most of those attacks even when credentials leak.

Here's the developer's-eye view.

Why it matters

Passwords fail because people reuse them. When a third-party service gets breached, attackers run credential-stuffing against your login endpoint. MFA adds a second factor that makes automated attacks economically pointless. IBM's Cost of a Data Breach 2026 report showed SMBs with MFA on all accounts cut breach costs by 67%.

Pick the right factor

MFA Type	Security	Cost	Best for
SMS codes	Low	Free	Fallback only
TOTP apps	Good	Free	Most SMB accounts
Push notifications	Good	£2-5/user/mo	Simple approval flows
Hardware keys (FIDO2)	High	£25-50 once	Admin & financial access
Passkeys (multi-device FIDO)	Highest	Free	Passwordless future

Skip SMS as a primary factor — NIST SP 800-63B no longer recommends it thanks to SIM-swap attacks (the UK NCSC logged a 340% jump in 2025).

TOTP is the sweet spot

Time-based one-time passwords work offline, cost nothing, and are trivial to integrate. If you're on Node, most of the work is one library:

import { authenticator } from 'otplib';

// Generate a per-user secret at enrollment
const secret = authenticator.generateSecret();

// Build the otpauth:// URI for the QR code
const uri = authenticator.keyuri(user.email, 'YourApp', secret);

// Verify the 6-digit code on login
const isValid = authenticator.verify({ token, secret });

Store secret encrypted at rest, render uri as a QR code (Google Authenticator, Authy, 2FAS all scan it), and gate the session on isValid.

Common pitfalls

No backup codes → users get locked out and disable MFA.
Verifying tokens without a replay window or rate limit.
Storing TOTP secrets in plaintext.
Treating SMS as your primary factor.

For anything privileged — admin panels, payment systems — step up to FIDO2/WebAuthn hardware keys. They're phishing-resistant in a way TOTP isn't.

Ship MFA before you ship the next feature. It's the cheapest security win you'll get all year.

Originally published on strongpassfactory.com