Password Generator with Real Randomness — and an Honest Strength Read

Draw passwords from the browser's cryptographic random numbers with rejection sampling, so no character is quietly favoured, then read the bits, the average number of guesses and what those numbers do not say about a password you typed yourself. Everything happens in this tab — what you type never leaves this device.

简体中文

Password length — 4 to 128 characters

Common lengths

Character sets — the pool is built from the ones you tick lowercase a–z uppercase A–Z digits 0–9 symbols (every printable ASCII symbol) leave out characters that are easy to confuse (i I l 1 L o O 0 | `) put at least one character from each ticked set into every password

Extra characters to add — for a site that demands something odd

Never use these characters — for a site that rejects them

How many to generate — 1 to 50

Measure a password you already have

Type or paste it — only arithmetic is done with it

How the randomness is drawn, and what it costs

How the randomness is actually drawn

Three things have to go right for a generated password to be worth anything, and most toy generators get at least one of them wrong.

The numbers come from the operating system. crypto.getRandomValues is the browser’s window onto the same source a password manager uses. Math.random is a V8 xorshift seeded from the clock: a few of its outputs are enough to work out the state and predict the rest, which turns “generated” into “guessable”. If a browser will not hand over cryptographic numbers, generation is refused rather than falling back to something quieter and worse.
The remainder is thrown away, not folded in. random() % 62 is not uniform: 4,294,967,296 does not divide by 62, so the first characters of the alphabet absorb the leftover values and come out slightly more often. The loop here draws again whenever the value lands in that leftover band. The bias was tiny and it is still refused, because “tiny bias” is exactly what a statistical fingerprint of a generator looks like.
The order is shuffled after the constraints. Requiring one uppercase, one digit and one symbol and then appending them in order gives every password the same shape. Here the characters are drawn first, then moved around with a Fisher–Yates shuffle that also uses rejection sampling.

What the bits number means here

For a generated password the arithmetic is honest: length × log₂(pool), so 20 characters from a 94-character pool is 131 bits. Every position really was picked from all 94 with equal chance, so the space is what it says.

For a password you typed, the same formula is a ceiling, not a measurement. Password123! uses four classes and 12 characters, which multiplies out to about 72 bits against the 63 characters it actually draws from — and it is among the first thousand guesses of any decent wordlist attack, because it is not a random draw from 63 symbols, it is a word with a suffix. The measure box therefore prints the alphabet estimate and the “characters you actually used” variant, and flags the patterns a real attacker enumerates before brute force begins: repeated runs, stepping runs like abcd, keyboard rows, and four-digit years.

The two speeds in the table

Guesses are one thing; guesses per second is the other. The table quotes two deliberately opposite rates:

10¹¹ per second stands for a large GPU rig attacking a dumped file of unsalted fast hashes (NTLM, or MD5/SHA used as a password hash). This is the number people mean when they say a password is “cracked in seconds”.
10⁴ per second stands for a login form that rate-limits, locks accounts, and never hands out its hash. The same password is seven orders of magnitude safer there.

A properly configured modern site with Argon2id or bcrypt makes even the first number far smaller, because hashing deliberately costs work. That is why the output prints time rather than a colour bar: a bar implies the site’s configuration is known, and it isn’t.

Nothing is stored; the screen is the storage

Nothing. No list of what you generated is written to storage, no history survives a reload, and nothing is sent anywhere: the characters are assembled from the pool in this tab’s script, so what you type never leaves this device. The candidates stay on screen until you press Clear or generate again, which is deliberate — but it also means the screen itself is the storage. Paste the one you want into your password manager, then regenerate.

Questions

Q: Should I use the copy button, or type it? The clipboard is shared with every other program on the machine, so pasting a password is a real (small) exposure, and the note printed after copying says so rather than pretending the clipboard is private. Typing it is stricter; a manager’s autofill is the best of the two.

Q: Is length really better than symbols? Yes, and measurably. Adding one character to a 20-character password from a 94-pool adds 6.5 bits; forcing a symbol set on a password that had one costs length wherever a site caps it. A 6-word diceware passphrase is comfortably stronger than Xq7!pL2@ for the same reason: the space is bigger, not because it is prettier.

Q: Why does the pool size change when I tick “leave out confusing characters”? Because those ten characters stop being available, so the pool shrinks and the bits per character fall with it. If you will retype the password by hand somewhere awkward, that trade is worth it; if a manager fills it, it is not.

Q: One from each class — why is that optional? It is a concession to sites that demand it, not a strength feature. A random 20-character password over the full pool already contains the classes most of the time; forcing them just removes a little entropy from a password that was never going to lack them.

Q: Can I generate 50 and keep the best one? They are all the same strength, because each was drawn the same way, so “best” has no meaning here. Pick the first one. If a site rejects it, use the never-use box to remove whatever the site rejects and generate again, rather than editing characters by hand — hand edits are where patterns come from.