Using SyncBackPro > Basic Operation > Generating and Checking Passwords

Overview

Password fields in a profile, e.g. for compression, FTP servers, cloud storage and email servers, have a password button on the left of the field. Use it to generate a new password, to check how strong a password is, and to check if a password is known to have been exposed in a data breach.

The password button cannot be used when the field uses a secret from the Secrets Manager, as the password is then stored in the secrets manager and not in SyncBackPro.

Generating a Password

If the password field is empty, click the password button to generate a new password:

•Click Yes when asked if you want to generate a new password.

•Enter the length of the password. The default is 20 characters, and it must be between 4 and 256 characters.

•The password is copied to the clipboard. Paste it somewhere safe now, e.g. into your password manager, or into the server or service that the password is for.

•Click OK to put the password in the password field, or Abort to discard it.

The clipboard is cleared as soon as that dialog window closes, so store the password before you close it. While the password is on the clipboard it is kept out of the Windows clipboard history (Win+V) and is not synchronized to your other devices.

A generated password contains upper and lower case letters, digits and symbols, with at least one of each. It is created using the Windows cryptographic random number generator. Symbols that often need quoting or escaping in command lines, scripts and configuration files (' " ` \) are not used.

Checking Password Strength

If the password field is not empty, click the password button to check how strong the password is. This check is done on your computer and the password is not sent anywhere.

The strength is estimated from how many guesses an attacker would need to find the password, using the zxcvbn algorithm. It looks for common passwords, dictionary words, names, keyboard patterns (e.g. qwerty), repeated characters, sequences (e.g. abc or 123), dates, and common letter substitutions (e.g. p@ssw0rd). It also looks for words an attacker who knows you would try first: the user name and server name entered for the profile, your Windows user name and computer name, and the name of the program. A long password made from unrelated words can be strong even without symbols, while a short password full of symbols can still be weak.

If the password is weak you are warned, usually with the reason, and you should choose a stronger password. The online check is not offered for a weak password.

Checking for a Compromised Password

If the password is not weak, you are asked if you want to check it online. This checks if the password appears in the passwords exposed in known data breaches, using the Pwned Passwords service from Have I Been Pwned. Attackers try these passwords first, so a password that has been exposed should never be used, however strong it looks.

Your password is never sent. SyncBackPro calculates the SHA-1 hash of the password and sends only the first 5 characters of the hash. The service returns every hash that starts with those characters, and SyncBackPro looks for a match on your computer. The service cannot tell which password was checked, or if it was found.

The check is only done when you click the password button and agree to it. It is never done automatically, e.g. when a profile is run.

The result is one of the following:

Do not use this password. It is a known compromised password.: the password has been exposed in a data breach. Change it, both in the profile and on the server or service that it is used for.

The password was checked online and was not found in any known data breach.: this does not mean the password is strong, only that it has not been seen in a breach.

The password could not be checked online.: the service could not be reached. The computer needs HTTPS access to api.pwnedpasswords.com, so check the Internet connection and the firewall.