What Makes a Password Generator Secure?

A secure password generator needs more than a mix of uppercase letters, numbers, and symbols. It should use cryptographic randomness, choose characters without bias, and create passwords long enough to resist guessing. Whether generation happens locally in your browser also matters for privacy.

Use a cryptographic random source

A generator’s random source determines whether its output can be predicted. JavaScript provides Math.random(), but it is designed for general-purpose tasks, not for security. Its output should not be used to create passwords, tokens, or other secrets.

For browser-based security tasks, the Web Crypto API provides crypto.getRandomValues(), a cryptographically secure source of random bytes. A generator can use those bytes to make unpredictable choices. The random source does not guarantee the entire tool is secure, though: the code must use it correctly and avoid leaking or reusing the result.

When evaluating a generator, look for a clear explanation that it uses a cryptographic random source. If you are building one, do not substitute Math.random() for a security-focused API.

Entropy: how many choices could an attacker face?

Entropy is a way to describe uncertainty. For a password made by choosing each character independently and uniformly from an alphabet of N characters, the theoretical entropy is:

password length × log₂(N) bits

Here, N is the number of possible characters at each position. For example, a 20-character password chosen uniformly from 62 uppercase letters, lowercase letters, and digits has about 119 bits of theoretical entropy: 20 × log₂(62).

That estimate depends on the generator’s method. It assumes every character is selected independently, every option is equally likely, and the password was not edited into a predictable pattern. A password that looks complicated is not necessarily unpredictable. A person may choose familiar words, a keyboard sequence, or a predictable substitution that an attacker can try early.

Entropy describes the number of possible outputs, not every aspect of account security. Password reuse, phishing, malware, and weaknesses in a service’s login protections can put an account at risk even when its password is hard to guess.

Avoid modulo bias

A generator can have a good random source and still map random values to characters unevenly. One common mistake is taking a random byte and using its remainder after division by the alphabet size. This is called modulo reduction.

For example, a byte can hold 256 possible values. If a generator selects from 62 characters using byte % 62, those 256 values do not divide evenly into 62 groups. Some characters will have five byte values that map to them, while others will have four. The difference may look small, but it means the choices are not perfectly uniform.

A standard solution is rejection sampling: discard random values outside a range that divides evenly by the alphabet size, then map the remaining values to characters. This keeps each character equally likely. A well-designed generator should handle this correctly rather than relying on a simple remainder operation.

Length versus character complexity

Longer passwords usually provide more resistance to guessing than short ones, especially when both are generated randomly. Adding more character types also increases the number of choices, but the gain from a longer password is usually larger: each additional character multiplies the number of possible passwords by the alphabet size, while adding a character type only enlarges the alphabet slightly.

Complexity rules can still be useful when a website requires certain character types. But forcing a password to contain one uppercase letter, one digit, and one symbol does not by itself make it secure. A short password that satisfies those rules may still have fewer possible combinations than a longer randomly generated password.

Use the longest password the service accepts, and let the generator meet any required character rules. Avoid shortening a generated password just to make it easier to remember; a password manager can store unique passwords for different accounts. The TIG Password Generator can help create a random password with settings suited to a site’s requirements. It uses crypto.getRandomValues with rejection sampling, runs entirely in your browser, and shuffles required character types into random positions.

Why local generation matters

When a password is generated entirely in your browser, the secret can stay on your device instead of being sent to a server. That reduces the number of places where it might be exposed. But “browser-based” alone does not prove that generation is local: a page could still send data elsewhere, and the browser or device itself may be compromised.

For sensitive passwords, use a generator you trust. Check how it handles generated values, and do not paste a real password into an unfamiliar strength checker or website. Browser extensions, clipboard history, screenshots, and shared or infected devices can also expose secrets. Clear the clipboard after copying if your device or workflow makes that appropriate.

A practical example

Suppose a work account accepts up to 20 characters and requires uppercase letters, lowercase letters, and digits. A reasonable approach is to generate 20 characters from those 62 options, confirm that the result meets the site’s rules, and save it in a password manager. Under the assumptions of uniform, independent selection, the password has about 119 bits of theoretical entropy.

If the site also requires a symbol, include symbols in the generator’s alphabet if the site allows them. Do not add a symbol manually in a predictable way, such as always appending !; that makes the password less random than a uniformly generated one. A strength checker can offer a useful second opinion, but its result is an estimate, not proof that a password is safe. Avoid submitting a password you already use. You can check a sample or a newly generated password with the TIG Password Strength Checker, which analyzes the password in your browser without sending it to a server.

What to look for in a generator

Before relying on a password generator, consider whether it:

• Uses a cryptographically secure random source, not Math.random().
• Selects characters uniformly, without modulo bias.
• Lets you choose an adequate length and the character types the site permits.
• Explains whether generation happens locally and whether generated values are transmitted.
• Avoids predictable defaults, such as always placing required character types in fixed positions.

The strongest practical password is one that is random, unique to its account, long enough for the service, and stored safely. Complexity is about the possibilities an attacker must search—not just how many kinds of characters appear on screen.

Summary

• Secure generators use a cryptographic random source such as the browser’s Web Crypto API, not Math.random().
• Entropy depends on password length, alphabet size, and truly uniform, independent choices.
• Modulo reduction can create uneven character probabilities; rejection sampling avoids that bias.
• Longer random passwords generally provide more guessing resistance than short passwords built to satisfy complexity rules.
• Local generation can limit exposure, but use a trusted tool and protect the password on your device.