Methodology
The exact math and process behind every password, PIN and passphrase this site generates.
Random generation
Each character is selected using window.crypto.getRandomValues() combined with rejection sampling: a 32-bit random value is drawn and discarded if it falls outside the largest multiple of the pool size that fits in the range, eliminating modulo bias. This guarantees a uniform distribution across the chosen character pool.
Character pools
- Lowercase letters (a–z): 26 characters
- Uppercase letters (A–Z): 26 characters
- Numbers (0–9): 10 characters
- Symbols (!@#$%^&*()_+~`|}{[]:;?><,./-=): 29 characters
The generator guarantees at least one character from every selected type before filling the remaining length randomly, then shuffles the result so the guaranteed characters are not always in the same position.
Entropy calculation
For a password of uniformly random characters, entropy in bits is:
entropy = length × log2(pool size)
Example: a 16-character password using all four sets has a pool size of 91 (26+26+10+29 — punctuation set used here has 29 characters), giving roughly 16 × log2(91) ≈ 104.7 bits. This assumes uniform random selection from the stated pool; it is not a guarantee against every real-world attack, such as reused or leaked passwords.
PIN combinations
For an N-digit numeric PIN, the number of possible values is 10^N:
- 4 digits: 10,000 combinations
- 6 digits: 1,000,000 combinations
- 8 digits: 100,000,000 combinations
Real-world PIN security also depends on factors outside this calculation, such as rate limiting, lockouts after failed attempts, and whether the PIN follows a predictable pattern (birthdays, repeated digits, keypad shapes).
Passphrase entropy
For a passphrase of w words drawn independently from a list of size N, entropy is w × log2(N). This site's passphrase generator draws from the EFF long wordlist, a public 7,776-word diceware list, giving log2(7776) ≈ 12.9 bits per word. The generator's default of six words gives roughly 6 × 12.9 ≈ 78 bits.
Limitations
These calculations describe the mathematical strength of a value chosen uniformly at random from a defined pool. They do not account for a password being reused across sites, exposed in a data breach, guessed through social engineering, or intercepted by malware on the device where it is typed.