Password Generator

Everything here happens in your browser. Nothing is sent anywhere, nothing is stored, and the password is gone the moment you close the tab. The settings are saved, because they are just settings, but what comes out of the generator never touches the address bar or your local storage.

Where the randomness comes from

A byte holds 0 to 255. Taking it modulo 62:

0, 62, 124, 186, 248  ->  a    five ways
1, 63, 125, 187, 249  ->  b    five ways
...
8, 70, 132, 194       ->  i    four ways

The first eight letters come up 25% more often
than the rest. Throwing away anything above 247
and asking again fixes it, and costs nothing.

The browser has a proper cryptographic generator built in, and this uses it. The interesting part is what you do with the number it hands back. Squashing a random value into a range with a remainder is the obvious move and it is slightly wrong: unless the range divides the number of possible values exactly, some outcomes get one more chance than others.

With a 32-bit value and 86 characters the bias is tiny, around one part in fifty million. It is still avoidable for free, so it is avoided. Values that would land in the uneven tail get thrown away and another one is drawn. The same picker does the shuffling, so the guaranteed digit does not always end up in the same place.

What the bits mean

20 characters, all four sets, at least one of each

every string of 20      86^20    = 4.9e38  128.53 bits
minus the ones with no digit       76^20 = 4.1e37
minus the ones with no symbol      62^20 = 7.0e35
minus the other two, then back again for
every pair that got taken off twice

what is left            4.5e38            128.39 bits

The requirement cost 0.13 bits. It is not nothing,
and it is not the point either.

Entropy here measures the machine, not the string. Two passwords can look equally random and be worlds apart if one came out of a list of a thousand and the other out of a list of a trillion. The figure is the log of how many passwords this tool could have handed you with these settings, so it answers the only question that matters: how many would somebody have to try.

Ticking "at least one of each" makes it go down, not up. Every string without a digit has been removed from what the generator could produce, so there are fewer of them for an attacker to search. The count above uses inclusion and exclusion to get the exact figure instead of pretending the requirement is free. The loss is small, and the reason to keep the box ticked is that sites demand it, not that it helps.

The pronounceable mode goes further and counts the word in front of you. Two different sets of syllables can land on the same letters, so that word was more likely to appear than the multiplication suggests, and it gets scored lower to match.

Length beats cleverness

Tr0ub4dor&3                   28 bits
correct-horse-battery-staple  44 bits

One is unreadable and weaker. The other is four
ordinary words. Randall Munroe made the point in
2011 and it has not stopped being true.

Substituting a 3 for an E and sticking an exclamation mark on the end is a transformation every cracking tool has known about for thirty years. It adds almost nothing to the search and a great deal to the difficulty of typing the thing on a phone.

Four or five words picked at random beat it comfortably, and you can say them out loud. The catch is the two words "at random". A phrase you thought of is not random, because you thought of it, and so did other people.

The rules that make things worse

A site that demands one capital, one digit
and one symbol in eight characters has
narrowed the search, not widened it.

The attacker knows the rule too.

Composition rules were a reasonable idea in 1985 and have been harmful ever since, without anybody noticing. NIST dropped them from its guidance in 2017, along with forced expiry, and now recommends length, a check against known breached passwords, and otherwise leaving people alone.

Forced rotation is the other one worth knowing about. Making people change a password every ninety days produces january2024, then april2024, and an attacker who has seen one has effectively seen them all.

How long the times are worked out

The figures assume an attacker who knows exactly how the password was made and searches that space and nothing else. Average time is half the space, because on average you find it halfway through. Four rates are shown because the answer changes by twelve orders of magnitude depending on who is asking.

Guessing at a live login is slow and gets you locked out. A stolen database hashed with bcrypt or argon2 is thousands of guesses a second. The same database hashed with unsalted SHA-256 is hundreds of billions, which is why the choice of hash on the other end matters more than anything you can do at this one.

What to actually do

Use a password manager and let it hold long random strings you will never read. Keep two or three passphrases in your head for the things that unlock everything else: the manager itself, your laptop, your email. Turn on two factor authentication wherever it is offered, because it survives the password being wrong.

And never reuse one. The most common way an account is lost has nothing to do with the strength of its password. It is that the same password was used somewhere that leaked.