Strong, random passwords
Learn how password strength is calculated mathematically and why pseudo-random number generators are critical to security.
Password strength is measured in Entropy (bits). It defines how many guesses a computer would need to brute-force the password.
The formula is E = L * log2(R), where L is the length of the password and R is the pool of possible characters. For example, an 8-character password using only lowercase letters (pool of 26) has ~37 bits of entropy. A 16-character password using uppercase, lowercase, numbers, and symbols (pool of ~70) has ~98 bits of entropy.
Modern security standards recommend at least 80-100 bits of entropy to withstand offline brute-force attacks using dedicated GPU clusters.
/dev/urandom).This tool uses window.crypto.getRandomValues() to fetch true secure randomness from the browser's CSPRNG. We then use modular arithmetic to map those random bytes securely onto the requested character sets.
A common bug when building custom password generators is Modulo Bias.
If you generate a random byte (0-255) and do % 62 to pick a character, the numbers 0-7 will be selected more frequently than the others because 256 is not evenly divisible by 62. Secure generators must discard random values that fall in the uneven upper bound to ensure perfect uniformity.
According to password entropy math, which change increases password strength MORE?