Password Generator: Where 'Looks Random' Isn't Good Enough

This is the one tool on the site where "looks random" and "is actually random enough for security" are genuinely different bars, and getting that distinction right mattered more here than in anything else I've built. A password generator that produces plausible-looking but weakly-random output isn't a lesser version of a password generator — it's actively worse than not having one, because it gives people false confidence in something that doesn't hold up to real attack.

Math.random() was never a serious option

JavaScript's default random number source is fast and fine for non-security uses — shuffling a game deck, picking a random enemy spawn point — but it's not designed to be unpredictable in the way password generation actually needs. The browser's cryptographically secure random API exists specifically for this: it pulls from an entropy source designed to be infeasible to predict, even if you know the exact algorithm generating it. Using anything else here would mean the strength badge and entropy readout I show next to every generated password would be describing a security guarantee the underlying randomness doesn't actually provide, which is worse than not showing an entropy number at all.

The entropy readout has to be honest, not just impressive-looking

Calculating entropy correctly means accounting for the actual character set in play — a 12-character password drawn only from lowercase letters has meaningfully less entropy than a 12-character password drawn from uppercase, lowercase, numbers, and symbols together, even though both are the same length. The readout recalculates based on exactly which toggles are active, not a fixed number per length, because a static entropy estimate that ignores the actual character set would overstate security the moment someone turns off symbols to satisfy some site's oddly restrictive password rules. I'd rather show a lower, accurate number than a higher, misleading one.

Passphrase mode is a genuine trade-off, not a lesser mode

Switching to a sequence of real words instead of random characters isn't a "casual" mode bolted on for convenience — it's a legitimate security trade-off with real research behind it. A long passphrase of several random words can carry comparable or greater entropy than a shorter random-character password, while being dramatically easier for a human to actually type correctly on a router setup screen or read aloud over the phone. The word list backing passphrase mode had to be large enough that the space of possible passphrases stays genuinely hard to guess — a small word list makes for an easy-to-remember passphrase and a much smaller effective search space for anyone trying to guess it, which would quietly undermine the entire premise of the mode.

The length slider's range needed real thought at both ends

Four to sixty-four characters is a wide range, and both ends needed their own justification rather than being arbitrary round numbers. The lower bound exists because some legacy systems genuinely cap password length that short, and a generator that refuses to go below eight or ten characters would be useless for exactly the systems that need the strongest possible password within their own restrictive limit. The upper bound exists because some sites cap password length on their end too, and generating something absurdly long that a target site would just silently truncate creates a worse outcome than a shorter password that's actually accepted in full. Supporting a wide range only matters if both ends of it map to a real constraint someone's actually going to hit.

The strength badge had to resist the urge to be generous

There's a real temptation to make a strength meter feel good to look at — everyone would rather see a green "Strong" badge than a yellow "Moderate" one. I calibrated the thresholds against actual entropy math rather than against what would make the badge feel encouraging most of the time, which means a short password with numbers turned off correctly shows as weak, even though it might "feel" reasonable to a user who just wants to get past a form field. A generous meter that rates everything favorably regardless of real strength would be actively worse than no meter at all, since it would train people to trust a signal that isn't measuring anything real.

What this tool deliberately doesn't do

There's no history of previously generated passwords kept anywhere, server-side or in persistent local storage, and that's a deliberate security choice rather than a missing feature. A password generator that remembers what it generated is a password generator that's created a new place those passwords could potentially leak from. Every password this tool produces exists only in the result field until you copy it or navigate away, and once you leave the page, it's genuinely gone. That's a slightly less convenient experience than a tool with generation history, and I think it's the correct trade for something whose entire purpose is producing secrets. If someone needs to hold onto a password generated here, the honest answer is to copy it into a real password manager right away, not to rely on this page to remember it for them.

Of everything I've built for this site so far, this is the tool where getting it quietly wrong would matter the most and be the hardest for anyone to ever notice. A slightly biased random number in the dice roller costs nothing. A slightly weaker-than-advertised password costs someone their account, potentially long after they've forgotten this tool is even where it came from. That asymmetry is why I spent more relative effort here on the parts nobody will ever specifically compliment — the randomness source, the entropy math — than on anything that affects how the page looks. That's the right ratio for a tool like this, even if it means the least visible work is also the most important work in the whole build, and the part nobody will ever ask me about directly, right up until the day it turns out to matter enormously to exactly one person having a very bad week they'll never even trace back to a random number generator they never thought twice about.