Password & Security Tools

Most online password generators are built on JavaScript's Math.random(). It is fast, it looks random, and its internal state can be recovered from a modest run of prior outputs — which means a password it produced is potentially reconstructable by anyone who has seen enough of what that page generated before. For a music shuffle that is irrelevant. For a password it is the entire ballgame.

These tools use the Web Crypto API, which reads the operating system's entropy pool — the same source that seeds TLS session keys. Its output cannot be reconstructed from previous output, no matter how much of it you have seen.

The mapping matters too. Folding raw entropy onto a character set with a modulo makes some characters more likely than others whenever the set size is not a power of two. Across a long password that skew is measurable, and it shrinks the search space an attacker has to cover. Every draw here uses rejection sampling instead.

Strength meters that show a red-amber-green bar are guessing, and they are frequently wrong — P@ssw0rd1 scores well on many of them despite being one of the first things any cracking dictionary tries.

These tools show entropy in bits, which is a measurement rather than an opinion: it is the base-two logarithm of the number of equally likely results the generator could have produced. Sixty bits means roughly a billion billion possibilities. That number is exact, because the generator knows precisely how it drew.

The crack-time estimate alongside it is deliberately secondary. It depends on assumptions about the attacker's hardware and how the site stored your password, neither of which you can see. Bits are the honest figure; time is context.

Adding a character class multiplies the search space once. Adding characters multiplies it every time. A sixteen-character lowercase-only password is stronger than an eight-character one using every symbol on the keyboard — and considerably easier to type.

This is why the composition rules many sites still enforce — one capital, one number, one symbol — do so little. They push people toward predictable patterns: a capital at the front, a digit and an exclamation mark at the end. Attackers know this, and their dictionaries are built around it.

The practical answer is a password manager holding long random strings you never type, and one memorable passphrase protecting it.