Create starter passwords for new staff or accounts in one go. Everything happens in your browser, including your list of names.

Make one yourself with a script

These scripts create a strong 20-character password on your own computer with the system’s cryptographic random generator, so the password never reaches Wachtwoordje.

PowerShell (Windows PowerShell 5.1 and PowerShell 7)

function New-StrongPassword {
    param([ValidateRange(8, 128)][int]$Length = 20)
    # Without look-alike characters (0 O o 1 l I |)
    $chars = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789!@#$%&*?-_=+'
    $limit = 256 - (256 % $chars.Length)  # rejection sampling: no modulo bias
    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
    $buf = New-Object byte[] 64
    try {
        do {
            $sb = New-Object System.Text.StringBuilder
            while ($sb.Length -lt $Length) {
                $rng.GetBytes($buf)
                foreach ($b in $buf) {
                    if ($b -lt $limit -and $sb.Length -lt $Length) {
                        [void]$sb.Append($chars[$b % $chars.Length])
                    }
                }
            }
            $pw = $sb.ToString()
        } until ($pw -cmatch '[A-Z]' -and $pw -cmatch '[a-z]' -and $pw -match '[0-9]' -and $pw -match '[^A-Za-z0-9]')
    } finally {
        $rng.Dispose()
    }
    $pw
}

New-StrongPassword -Length 20

bash or zsh (macOS and Linux)

new_password() {
  # Without look-alike characters (0 O o 1 l I |)
  local LC_ALL=C len="${1:-20}" pw
  case $len in
    ''|*[!0-9]*|????*) len=0 ;;
  esac
  if [ "$len" -lt 8 ] || [ "$len" -gt 128 ]; then
    echo 'new_password: choose a length from 8 to 128' >&2
    return 2
  fi
  while :; do
    pw=$(head -c 4096 /dev/urandom | tr -dc 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789!@#%*?_=+-')
    pw=${pw:0:len}
    [[ ${#pw} -eq $len && $pw =~ [A-Z] && $pw =~ [a-z] && $pw =~ [0-9] && $pw =~ [^A-Za-z0-9] ]] && break
  done
  printf '%s\n' "$pw"
}

new_password 20

How do I give new staff a password safely?

Hand over the starter password in person or on paper, separately from the username, and never in the same email as the account address. Working remotely? Send it with Share a secret: a link that works once. Print cards above or load the list into your admin portal, and have everyone change the password right away and turn on two-step verification.

Why should a starter password be changed?

Because more people have seen it: you as the admin, and perhaps whoever found the card. Only when the employee picks a new password is it known to them alone. In Microsoft 365, turn on the option that requires the user to change their password at first sign-in.

Are the names or passwords stored?

No. Names and passwords stay in your browser and are never sent anywhere or kept. Your browser creates the CSV and the cards itself. We only count anonymously which buttons are used, without any names or passwords.

For help with Microsoft 365 or the rest of your IT, you can turn to Vienix, the maker of Wachtwoordje.

Passwords for your whole team.