Password Generator

What does the password generator do?

This page is more than a strength meter. It is a local, multi-mode password generator with three current modes:

• random: random-character passwords
• pin: numeric PINs
• diceware: word-based passphrases

After generation, the page shows an entropy-based strength level and supports copying, batch generation, and local history. Its random source is browser crypto.getRandomValues(), which is more appropriate for security-sensitive generation than Math.random().

One important boundary: the current strength result is a theoretical entropy estimate. It is not a breach checker, policy validator, or full crack-time simulator.

Good fits

• generating login passwords
• creating test PINs
• creating memorable passphrases
• producing multiple candidate secrets at once

Privacy note

Recent results are stored in browser-local history for convenience. That is helpful on a personal device, but worth clearing on a shared machine.

References

• NIST SP 800-63B
• MDN: Crypto.getRandomValues()
• EFF Dice

How to use it

1. Choose a mode

• random: general-purpose login passwords
• pin: numeric PINs for devices or testing
• diceware: easier-to-read passphrases made of words

2. Configure the mode

Different modes expose different controls:

• random passwords: length, enabled character classes, ambiguous-character exclusion, count
• PINs: length and count
• Diceware: word count, separator, custom separator, count

3. Generate and review strength

After clicking generate, the right side shows the result list plus the current strength meter. Strength is based on entropy, so longer secrets and larger choice spaces usually score higher.

4. Copy or revisit history

You can copy individual outputs and review recent history. History is stored locally in the browser and capped to a limited number of entries.

References

• NIST SP 800-63B
• MDN: Crypto.getRandomValues()
• EFF Dice

Mode reference

1. Random character mode

If every character class is disabled, the current implementation falls back to lowercase.

2. PIN mode

3. Diceware mode

Strength levels

Current thresholds:

• < 40: weak
• < 60: fair
• < 80: strong
• >= 80: very-strong

References

• NIST SP 800-63B
• MDN: Crypto.getRandomValues()
• EFF Dice

FAQ

Is the randomness secure?

The generator uses browser crypto.getRandomValues(), which is designed for cryptographically secure random values and is more appropriate than Math.random() for security-sensitive generation.

Why are Diceware words English?

Because the current implementation uses a fixed EFF English Diceware wordlist and does not expose multilingual wordlists.

Why doesn’t “very strong” mean absolutely safe?

Because the score is entropy-based only. It does not check breach exposure, password reuse, local handling, or context-specific risk.

Is local history safe?

It stays in browser-local storage and is not uploaded, but plaintext local history is still a risk on shared or unmanaged devices.

Why does random mode force each enabled character class to appear?

This avoids surprising outputs such as “numbers enabled but no numbers present” and aligns better with common password policy expectations.

References

• NIST SP 800-63B
• MDN: Crypto.getRandomValues()
• EFF Dice

Entropy, length, and memorability

The current strength meter uses a theoretical entropy model:

• random character passwords: log2(character set size) × length
• Diceware: log2(wordlist size) × word count

This model is simple and useful for comparing configurations, but it does not capture whether a password is reused, written on paper, stored insecurely, or already exposed in a breach corpus.

Why Diceware matters

Diceware trades symbol density for memorability. With enough truly random words, it can offer a strong balance between security and usability.

Why the random source matters

Strong settings are not enough if the random source is weak. crypto.getRandomValues() matters because it provides browser APIs meant for security-oriented randomness.

References

• NIST SP 800-63B
• MDN: Crypto.getRandomValues()
• EFF Dice

Practical tips

Use random mode for most website passwords

For most login workflows, a sufficiently long random password is still the safest default.

Prefer Diceware when humans must remember it

If a secret must be typed and remembered by a person, several random words are often more practical than a dense symbol string.

Do not treat PINs as high-value master passwords

PINs are better suited to devices, test accounts, and short-lived scenarios than to your most sensitive primary secrets.

Clear history on shared devices

Because recent outputs are stored locally in the browser, shared computers deserve extra caution.

Excluding ambiguous characters helps with transcription

If the secret will be read aloud, copied by hand, or sent over chat, removing 0Ool1I can reduce mistakes.

References

• NIST SP 800-63B
• MDN: Crypto.getRandomValues()
• EFF Dice