Password Generator

Every password has a search space: the number of guesses an attacker must make to exhaust it. That space is poollength, which is why length is such a powerful lever. Adding one character to a password multiplies the work by the size of the whole character pool.

A mixed-case, digit and symbol password has a pool of 94 characters, so each character adds about 6.6 bits of entropy. A 12-character password from that pool is roughly 79 bits. A 20-character password from the same pool is about 131 bits — more than 50 billion times harder to brute-force.

The practical consequence: if you are choosing between a shorter password with every character class and a longer one without, take the longer one. Then check the result with the Password Strength Checker to see the entropy and crack-time estimate for any password you are considering.

Randomness is the whole game in password generation, and it is easy to get subtly wrong. This generator uses crypto.getRandomValues(), which draws from the operating system's cryptographically secure random number generator — the same source used for TLS keys and session tokens.

It then applies rejection sampling. The obvious shortcut is to take a random byte and compute byte % 94, but because 256 is not a multiple of 94, that makes the first 68 characters of the pool slightly more likely than the rest. Rejection sampling discards the values in that incomplete final block and re-rolls instead, so every character in the pool is equally likely.

Math.random() is never used. It is fast, but its output is predictable from a small number of previous values, which makes passwords generated from it guessable regardless of how long they are.

Each character class contributes a fixed number of characters to the pool. The entropy figure above is calculated from whichever classes you enable, so you can see exactly what each choice buys you.

• Lowercase:26 characters (a-z) — adds 4.70 bits per character
• Uppercase:26 characters (A-Z) — adds 4.70 bits per character
• Digits:10 characters (0-9) — adds 3.32 bits per character
• Symbols:32 punctuation characters — adds 5.00 bits per character

Enabling all four gives a pool of 94 characters and a total of about 6.55 bits per character. Symbols are the single most valuable addition, but they are also the class most likely to be rejected by a legacy system — in which case turn them off and add length instead.