Strong password field surrounded by weak password warnings
Back to work

Microsoft · Security · Product design

Password generator

Enhancing digital safety through strong passwords

Type
Interaction design
Duration
Sep ’21 – Nov ’21
Tools
Figma
Client
Microsoft
Status
Shipped

Background

We store an ever-increasing amount of personal and sensitive data online. As our reliance on digital accounts grows, so does the concern for cyber safety and data security. Today, many security breaches can be traced back to the use of weak passwords.

Scroll across to see all five years.

Breach entry points from 2020 to 2024Credentials lead all five years, peaking at approximately 64% in 2021 and falling to 38% in 2024. Phishing falls from about 26% to 15%, while vulnerability exploitation rises from about 5% to 14%. Approximate annual values are available in the table below.0%20%40%60%202020212022202320242020 · Credentials: approximately 49%2021 · Credentials: approximately 64%2022 · Credentials: approximately 48%2023 · Credentials: approximately 50%2024 · Credentials: approximately 38%2020 · Phishing: approximately 26%2021 · Phishing: approximately 35%2022 · Phishing: approximately 17%2023 · Phishing: approximately 13%2024 · Phishing: approximately 15%2020 · Vulnerability exploitation: approximately 5%2021 · Vulnerability exploitation: approximately 3%2022 · Vulnerability exploitation: approximately 6%2023 · Vulnerability exploitation: approximately 5%2024 · Vulnerability exploitation: approximately 14%
  • Credentials
  • Phishing
  • Vulnerability exploitation
Approximate percentages reconstructed from the original chart; rounded to the nearest whole percentage point.
View approximate values
YearCredentialsPhishingVulnerability exploitation
202049%26%5%
202164%35%3%
202248%17%6%
202350%13%5%
202438%15%14%

Credential-based attacks remain the most common of these three breach entry points, despite the decline from 2021. Source: Verizon 2024 Data Breach Investigations Report (PDF)

Why strong passwords are hard to use.

What makes a password weak? Simply put, a password is weak if it can be guessed or interpreted by anyone other than the account owner. Reusing the same password across multiple accounts also makes it weak.

The recommendation is to use passwords that are:

  • Pattern free – no predictable sequences or decipherable logic
  • Hard to guess – not based on personal or related information
  • Unique – different for every account
  • Complex – a mix of uppercase and lowercase letters, numbers, and special characters

In technical terms, strong passwords have high entropy—meaning they’re highly unpredictable.

Creating a strong, unique password for every account is hard, and remembering them all is harder. Yet they significantly reduce the chance of an account being compromised.

Number of
characters		Numbers onlyLowercase lettersUpper & lowercaseNumbers & lettersWith symbols, too
4InstantlyInstantlyInstantlyInstantlyInstantly
5InstantlyInstantlyInstantlyInstantlyInstantly
6InstantlyInstantlyInstantlyInstantlyInstantly
7InstantlyInstantly1 sec2 secs4 secs
8InstantlyInstantly28 secs2 mins5 mins
9Instantly3 secs24 mins2 hours6 hours
10Instantly1 min21 hours5 days2 weeks
11Instantly32 mins1 month10 months3 years
121 sec14 hours6 years53 years226 years
135 secs2 weeks332 years3 thousand years15 thousand years
1452 secs1 year17 thousand years202 thousand years1 million years
159 mins27 years898 thousand years12 million years77 million years
161 hour713 years46 million years779 million years5 billion years
1714 hours18 thousand years2 billion years48 billion years380 billion years
186 days481 thousand years126 billion years2 trillion years26 trillion years

Source: How Long Does It Take for a Hacker to Crack a Password? 🤔 (tech.co)

Brief

Design a password generator for Microsoft Authenticator & Microsoft Autofill Chrome extension that fits into the flow of creating an account or updating a password, without requiring people to open the tool. Once someone uses a suggested password, it should be saved automatically, so they don't need to remember it.

My role

I took over the project after the in-app experience had been designed. I refined the in-app experience, designed the flow for generating passwords without leaving the sign-up page, and solved for offline password use. I was also responsible for meeting Microsoft's accessibility standards and privacy and legal requirements.

Findings

Initial research raised two important considerations:

  1. People wanted to use the generator beyond online accounts, for example for PDF or Excel files, Wi-Fi networks and hard drives.
  2. Strong passwords can look intimidating, and so can the customization options. We learned this when we tested the first prototype with users.

Approach

Keep the choice. Reduce the intimidation.

Initially, we displayed all customization options alongside the generated passwords. However, the interface felt so complex that many research participants chose to skip the suggestion entirely and type their own passwords, which defeated the purpose. Since removing customization wasn’t an option, I redesigned the flow to hide these options by default in the in-context view. They remained visible in the in-app view, where the purpose and user expectations were different.

We expected people to confuse characters such as 1 and I, or 0 and O, so we colour-coded passwords to distinguish letters, numbers and special characters.

Further details are confidential.

Final design

The final version, demonstrated in the animations I created for the Microsoft blog post announcing the feature: Generate strong passwords with Microsoft Authenticator - Microsoft Community Hub

Android — A strong password is suggested while creating an account in the browser.
iOS — Generate and use a strong password without leaving the sign-up flow.
Chrome extension — Microsoft Autofill suggests a strong password directly in the sign-up form.

Impact

Like many Microsoft products, this feature attracted significant attention in tech blogs and online communities. While I can’t share the exact numbers, these articles offer a glimpse into how the community at large received it.

Microsoft Community Hub — Generate strong passwords with Microsoft Authenticator.Read the announcement
Android Police — Microsoft's password manager just got a new feature you probably thought it already had.Read the report
Petri — Microsoft Authenticator Now Lets Users Generate Strong Passwords.Read the report

Learnings & conclusion

This project was an important milestone in my journey at Microsoft. I worked with many teams and stakeholders to bring it to reality. When dealing with credentials, accessibility and privacy are essential, and I made sure the experience never came at the cost of compliance.