FM 4-03 Chapter 4 · Security and crypto
Password generator
Random passwords and EFF diceware passphrases from the browser CSPRNG, with exact entropy.
Local only Runs in your browser. Nothing you enter leaves this page.
Candidates
- Loading wordlist
- Entropy
- 130.9 bits
- Generation space
- 94^20 minus strings missing a set
- Offline, 10^10 guesses/s
- about 10^21 years on average
- Online, 100 guesses/hour
- about 10^33 years on average
- Rough rating
- Very strong
Entropy is counted from the generator, not guessed from the output: the attacker is assumed to know the method, the character sets or wordlist and every option, and only the random choices are secret. Times are the average, half the space. 10^10 guesses per second is a GPU rig against a fast unsalted hash such as MD5 or NTLM. A slow hash (bcrypt, scrypt, Argon2) makes offline attacks many orders of magnitude slower. 100 per hour is an online login with throttling.
Randomness comes from crypto.getRandomValues with rejection sampling, so every character or word is equally likely. Nothing is stored or sent; only the options go into the link.