CSPRNG Cryptographic Password Generator

Standard JavaScript Math.random() relies on deterministic Pseudo-Random Number Generators (PRNGs) such as xoshiro128**, which are seeded by system clocks and susceptible to state reconstruction by adversaries. In contrast, the Web Cryptography API (crypto.getRandomValues) accesses operating-system-level entropy pools (such as /dev/urandom on Unix or CryptGenRandom / CNG on Windows). This Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) guarantees true non-deterministic unpredictability suitable for cryptographic key generation.

A common security flaw in naive password generators is modulo bias: using randomByte % poolLength when the byte range (256) is not evenly divisible by the pool size. This gives lower-indexed characters a higher probability of selection. Our generator uses unbiased rejection sampling, discarding any random integer above the largest multiple of the pool length to ensure uniform distribution across every possible character.

Password strength is mathematically quantified through Information Entropy, measured in bits:

• Formula: $H = L \times \log_2(N)$, where $L$ is password length and $N$ is total character pool size.
• Pool Sizes: Lowercase ($N=26$), Mixed Alpha ($N=52$), Alphanumeric ($N=62$), Full Printable ASCII ($N=94$).
• Entropy Thresholds: Under 50 bits is weak (crackable in seconds), 60–80 bits is moderate, and above 100 bits provides astronomical resistance against distributed GPU cracking clusters.