True Random Password Generator - Strong Secure Passwords

A strong password is one an attacker cannot guess faster than trying every possibility — and that property comes from two things only: the size of the character pool and the number of characters drawn from it. This password generator builds passwords character by character from crypto.getRandomValues(), the cryptographically secure random number generator (CSPRNG) that browsers expose through the Web Crypto API. Unlike Math.random(), whose output can be predicted once its internal state is known, a CSPRNG is seeded by the operating system's entropy sources and is designed to be unpredictable even to an attacker who has seen previous output. The generator also applies rejection sampling. A naive implementation maps a random byte onto the character pool with a modulo operation, which slightly favours characters at the start of the pool whenever 256 is not an exact multiple of the pool size. Here, bytes that would introduce that bias are simply discarded and redrawn, so every character in the pool is chosen with exactly equal probability. You control the recipe: length from 4 to 128 characters, and any combination of lowercase letters, capital letters, digits, and punctuation symbols. The ambiguous-character option removes the five glyphs most often confused in print or on screen — zero versus capital O, and one versus lowercase L versus capital I — which is worth enabling for passwords someone might read aloud or type from paper, such as a Wi-Fi key. Note that shrinking the pool this way costs a small amount of strength per character, so add a character or two of length to compensate. Alongside each password the tool reports its theoretical strength in bits, computed as the length multiplied by the base-2 logarithm of the pool size and rounded down. Every additional bit doubles the number of guesses required, so a value in the range of 75 to 90 or more puts a password comfortably beyond offline brute-force attacks for the foreseeable future; around 128 it is effectively unguessable. The calculation assumes truly random selection — it does not apply to passwords a human made up, because names, words, and keyboard patterns are guessed by dictionary attacks long before raw brute force matters. Everything happens in your browser: no password is transmitted, logged, or stored, and refreshing the page destroys it. For day-to-day use, pair generated passwords with a password manager so each account gets a unique one, and prefer greater length over exotic symbols when a site limits which characters you may use. For those who want randomness rooted in a physical process, an optional true-random mode is available. It fetches eight 16-bit integers derived from atmospheric radio noise via RANDOM.ORG's public HTTP interface, combines them into a single 128-bit seed, and drives the sfc32 pseudorandom generator from that seed to pick every character — applying the same rejection-sampling rule, so no character is favoured. Two honest caveats come with it: the seed integers travel over the network (the finished password never does — it is assembled locally in your browser), and once seeded the character sequence is deterministic, so the password's unpredictability rests on the 128-bit atmospheric seed rather than on your operating system's continuously replenished entropy. That is why the local CSPRNG remains the default and the recommended choice for secrets; the seeded mode exists for people who value entropy traceable to a physical, non-algorithmic source. If random.org is unreachable or its per-IP quota is exhausted, the tool automatically falls back to the local CSPRNG, tells you so with a note, and the source badge under the result always states which path actually produced your password. The entropy figure shown is unaffected by the source choice, since it depends only on the length and pool size.