Skip to content

Frequently Asked Questions

  1. Why passwords generated with AegisPass sometimes does not seem random?

    Well, true randomness is a hard thing to achieve and to measure. We are used to algorithms that tailor the output to our needs and to seeing patterns in the output. Sometimes you may see a pattern in the output of AegisPass, but that does not mean that the output is not random. AegisPass uses cryptographically secure random numbers along with the possibility of using random.org to generate random passwords, providing enhanced security for your applications and services to generate Randomness Mixing and achieve a high level of entropy.

  2. Does AegisPass use random.org by default?

    No. By default AegisPass only uses cryptographically secure random numbers from your OS and works offline. random.org is only used when you pass the --online flag. I'm trying to find a more reliable way to implement randomness mixing in AegisPass, but for now random.org seems like the best option. Even if someone has the numbers generated from random.org they can't predict your password, because they are used to pick characters from a set that was already shuffled locally with crypto/rand.

  3. Does AegisPass keep my passwords in memory?

    AegisPass never saves passwords to disk, and it overwrites them in memory with zeros right after printing them. The shuffled character sets and the numbers fetched from random.org are wiped too, since they could be used to rebuild the password. Go can still leave copies you can't reach (for example when the runtime grows a goroutine stack), so think of this as reducing exposure, not removing it. Once the password is printed, your terminal scrollback, anything you pipe it into, or your clipboard manager may still keep it.