How the Password Generator Works

Strong and random — what those words actually mean

Most people use passwords that are memorable: a word, a date, a pattern. The problem is that attackers know this too. Dictionary attacks, credential stuffing from breached databases, and targeted guessing all exploit the fact that human-chosen passwords follow predictable rules.

A strong password has two properties: it is long, and it is random. Length multiplies the number of possible passwords an attacker has to try. Randomness guarantees you haven't accidentally landed on a pattern they already know to check.

What makes a password hard to crack

Every login system effectively asks: "Is this password the right one?" An attacker trying to brute-force an account has to cycle through guesses until they hit it. The measure of how hard that is is called entropy, expressed in bits.

Entropy depends on two things: the alphabet (how many distinct characters you draw from) and the length (how many characters you draw). Each extra character you add multiplies the search space by the alphabet size. Each extra character type you add (switching from lowercase-only to lowercase + digits, for example) expands the alphabet.

A 20-character password using lowercase, uppercase, digits, and symbols carries about 131 bits of entropy. At a billion guesses per second — fast by current standards — an attacker would need trillions of years to exhaust that space. The tool shows you the entropy estimate so you can see exactly what you're getting.

Why `Math.random` is not good enough

The browser has two sources of randomness. Math.random is the familiar one — fast, convenient, and built into JavaScript for decades. The problem is that it is seeded from a predictable internal state. An attacker who observes a few outputs can reconstruct that seed and predict the rest. Password-cracking tools already automate this attack.

This generator uses crypto.getRandomValues instead — the same API the browser uses when establishing a TLS connection. It draws from a hardware entropy source: a combination of thermal noise, interrupt timing, and the operating system's entropy pool. The output is unpredictable to anyone who doesn't have physical access to your hardware.

Rejection sampling — keeping the distribution uniform

Raw random numbers from crypto.getRandomValues are integers in a range like 0–255. To turn them into characters without bias, you can't simply take the remainder after dividing by the alphabet size — that would make some characters slightly more likely than others if the range doesn't divide evenly.

The generator uses rejection sampling: draw a random number, throw it away if it falls in the biased tail of the range, try again. The result is that every character in your chosen alphabet has exactly equal probability of appearing in each slot. The distribution is uniform.

What happens when you press Generate

The tool reads your length setting (4–128 characters) and the character classes you've checked: lowercase a–z, uppercase A–Z, digits 0–9, or symbols.
It assembles the active alphabet from those classes.
It fills an array of the requested length, picking one character per slot using crypto.getRandomValues and rejection sampling.
It displays the result and computes the entropy estimate.
Nothing is sent to a server. The password exists only in this tab.

What to do with the result

Copy the password directly into a password manager — 1Password, Bitwarden, iCloud Keychain, or your browser's built-in vault. That's the right place for long-term storage. A password generator that also stored passwords would undermine the privacy guarantee; there's no way to keep a password both accessible and off any server.