A tool that builds passwords from cryptographically secure randomness.
What sets it apart: instead of just claiming it is safe, it lets you check for
yourself. A common implementation picks each character with
random % alphabet size, plain naive modulo, and unless the alphabet size
divides 256 evenly this is always biased. This tool avoids the bias with
rejection sampling, and shows the difference by actually drawing
the same number of times from both and plotting a histogram with a chi-square test
(see "Why does naive modulo end up biased?" below). Beyond generating, it can also
diagnose a password you already use.
| Brute force (average) | rate assumed | time it would take |
|---|
This is a brute-force-only estimate. Dictionary attacks and the kinds of pattern weaknesses listed under "Traps" below are not covered by the entropy number alone.
Nothing to flag right now.
Not only what this page generates — you can diagnose a password you already use, right here. It never sends anything anywhere, so trying a real password does not leak it. Even so, it is best to avoid your single most important, reused password (your main email account, say).
Nothing entered yet.
Fold a random byte (0-255) down to an alphabet of n characters with
v % n, and unless 256 divides evenly by n, the leftover skews some characters
toward being picked more often. Rejection sampling avoids this by
re-drawing any byte at or past the divisible range
(Math.floor(256/n)*n). Beyond the theory, this draws from both methods the
same number of times for real and plots a histogram with a chi-square test.
crypto.getRandomValues.
Math.random() leaves the implementation up to the engine, and in most
browsers it is a generator not designed for cryptographic use (V8 uses an
xorshift128+ family). Its internal state can sometimes be recovered from a handful of
outputs, so it must never be used to generate passwords.v % n). Unless 256 divides evenly by the alphabet size n, the
leftover skews some characters to be picked more often (you can confirm this yourself
with the experiment above). Rejection sampling avoids it by re-drawing any byte
past the divisible range.