Skip to main content

Strong Password Generator

Generate cryptographically secure passwords with granular character pool controls and real-time entropy estimation.

Click Generate to start

Strength:Medium

Customize Password

*Generated password length is limited to 50 characters by the API.

Technical Architecture: Reverse-Engineering Password Generation​

Generating cryptographically secure passwords requires avoiding pseudo-random bias common in standard pseudo-random functions like Math.random(). The underlying generator couples hardware entropy with an unbiased shuffling algorithm to guarantee representation across all requested character sets.

1. CSPRNG Character Sampling & Fisher-Yates Shuffling​

To prevent modulo bias, characters are selected by sampling random bytes directly from the host operating system's cryptographic entropy source. To guarantee that every selected character type (uppercase, lowercase, digits, symbols) appears at least once in the generated output, initial characters are drawn deterministically from each category and the entire array is then randomized using an in-place Fisher-Yates shuffle:

function generateSecurePassword(
  length: number,
  pools: { upper: string; lower: string; digits: string; symbols: string }
): string {
  const chars: string[] = [];
  const activePools = Object.values(pools).filter(p => p.length > 0);
  
  // Guarantee at least one character from each active category
  activePools.forEach(pool => {
    const randomByte = new Uint8Array(1);
    window.crypto.getRandomValues(randomByte);
    chars.push(pool[randomByte[0] % pool.length]);
  });

  // Fill remaining length from combined character set
  const fullSet = activePools.join('');
  const remaining = length - chars.length;
  const buffer = new Uint8Array(remaining);
  window.crypto.getRandomValues(buffer);
  
  for (let i = 0; i < remaining; i++) {
    chars.push(fullSet[buffer[i] % fullSet.length]);
  }

  // Unbiased Fisher-Yates shuffle
  const shuffleBytes = new Uint32Array(chars.length);
  window.crypto.getRandomValues(shuffleBytes);
  for (let i = chars.length - 1; i > 0; i--) {
    const j = shuffleBytes[i] % (i + 1);
    [chars[i], chars[j]] = [chars[j], chars[i]];
  }

  return chars.join('');
}

2. Shannon Entropy & NIST SP 800-63B Guidelines​

Password strength is evaluated by calculating bits of Shannon entropy based on pool cardinality N and password length L:

E = L × log₂(N)

According to NIST Special Publication 800-63B (Digital Identity Guidelines), passwords should resist modern offline cracking clusters capable of exceeding 10¹¹ SHA-256 hashes per second. A password with 80+ bits of entropy is computationally infeasible to brute force within typical authentication lifetimes.

Password Pool Entropy Reference Table​

Character PoolCharacter SetPool Size (N)Recommended LengthEntropy RatingResilience
Numeric0-91020+ chars~66 bitsVulnerable to offline dictionary attack
Alphabetic Lowera-z2616+ chars~75 bitsModerate
Alphanumerica-zA-Z0-96214+ chars~83 bitsStrong against online cracking
Full Printable ASCIILetters + Digits + Symbols9416+ chars~105 bitsNIST SP 800-63B High-Security Standard
Extended High-SecurityFull printable ASCII9424+ chars~157 bitsComputationally unfeasible to brute-force

Client-Side Security & Zero-Server Data Isolation​

  • Zero Plaintext Transmission: Passwords are generated directly in memory via Web Crypto and backend zero-logging endpoints. No generated passwords, user options, or clipboard operations are transmitted across analytics, log drains, or third-party trackers.
  • No Client Storage: Unlike tokens or session identifiers, passwords are never stored in localStorage, cookies, or browser caches. Refreshing the tab immediately discards the current password from active memory.
  • CSPRNG Source: Backed by operating system kernels (/dev/urandom / CryptGenRandom) ensuring non-deterministic statistical distribution with zero predictable seed reuse.

Get notified about updates to this tool

No spam. Just high-quality updates about new features and guides.

Last updated on