Password Generator

Password strength is quantified as entropy in bits, computed as the length multiplied by the base-2 logarithm of the character pool size. Because length is the exponent in the underlying count of possibilities, adding characters buys far more than adding symbol types. Enabling all four sets in this generator produces a pool of 88 characters (26 uppercase, 26 lowercase, 10 digits, and 26 punctuation marks), worth about 6.46 bits each, so a 16-character result carries roughly 103 bits. Restricting the pool to lowercase letters yields 4.70 bits per character, and matching that same 103 bits would then require 22 characters. Every additional bit doubles the expected work of an exhaustive search. The entropy figure is valid only for strings drawn uniformly at random, which is why generation here uses the Web Crypto getRandomValues interface rather than Math.random; the latter is not a cryptographically secure generator and its future output can be inferred from observed values. Two caveats follow. Entropy describes the generation process and not the resulting string, so a random output that happens to resemble a word is neither weaker nor stronger than any other. And entropy is irrelevant to the outcome if the password is reused across sites, captured by a phishing page, or stored by a service that later leaks it, which is why unique per-site credentials held in a manager matter far more than extending length beyond roughly 20 characters.

Passwords entered computing with time-sharing. Fernando Corbato has described introducing them for the Compatible Time-Sharing System at MIT in the early 1960s, for the practical reason that users of one shared machine needed to be kept out of each other's files. The idea of measuring unpredictability in bits comes from Claude Shannon, whose 1948 work founding information theory supplied the logarithmic measure that entropy calculations still use. In 1979 Robert Morris and Ken Thompson published Password Security: A Case History, documenting how readily user-chosen passwords on Unix systems fell to dictionary attacks and describing the salted hash design that shaped credential storage for decades afterward. Advice on choosing passwords later reversed direction. NIST Special Publication 800-63, drafted by Bill Burr and published in 2003, recommended mixed character classes and periodic expiry; Burr publicly disavowed that guidance in 2017, saying the evidence had never supported it. The 2017 revision, SP 800-63B, dropped composition rules and scheduled rotation, instructed verifiers to accept passwords of at least 64 characters, and required screening candidates against lists of known breached values instead. Arnold Reinhold's Diceware method, published in 1995, had already made the same underlying argument from the opposite direction: strength comes from genuine randomness and length, not from decorating a memorable word with substituted punctuation.