Method / assumptions / examples
How this generator works
Each run uses fresh browser cryptographic randomness. Here is how the generator satisfies the selected policy without sending the result away.
Method
Uniform browser-crypto sampling from the selected character pool, rejecting candidates that miss a required group
Each character index comes from Crypto.getRandomValues rather than Math.random. Rejection sampling removes modulo bias and rejects whole candidates that do not contain every selected character group. This produces a uniform selection from the passwords that satisfy the chosen policy. Generated values stay in browser memory and are never submitted to CalcDB.
Worked example
Examples
Twenty random characters drawn from lowercase, uppercase, numbers, and symbols provide a very large policy search space and are practical to store in a password manager.
Exclude ambiguous characters when a password must be read or typed manually; the generator removes I, l, 1, O, o, and 0.
Common mistakes
What to check before using the result
- Use a unique password for every account and store it in a reputable password manager rather than memorizing or reusing generated values.
- Choose the longest password the service accepts. Composition rules can reduce usability, so disable only the groups a particular service rejects.
- A search-space estimate describes generated randomness, not the security of a compromised device, unsafe clipboard, weak account recovery, or breached service.
- Enable multifactor authentication or a passkey when the account offers it; a strong password does not prevent phishing by itself.
FAQ
Frequently asked questions
Are generated passwords sent to CalcDB?
No. Generation and copying happen in your browser. The generated values are not placed in the URL, stored by CalcDB, or sent to an API.
Does this use Math.random?
No. It uses the browser Web Crypto API and unbiased integer sampling. Math.random is not intended for security-sensitive generation.
What does the bit estimate mean?
It is the base-2 logarithm of the valid password space for the selected length and required groups. It is not a promise about an account provider's storage, rate limits, or recovery process.
Why require every selected character group?
Some services enforce composition policies. The generator uniformly samples only passwords that contain at least one character from every group you enable.
Primary references