Question 1

Is it safe to use browser-generated passwords?

Accepted Answer

crypto.getRandomValues() is a CSPRNG — the same underlying entropy source used by TLS key generation and OS-level random number generation. It is safe for generating passwords. The risk is not generation quality but storage: always use a password manager rather than writing generated passwords down.

Question 2

Why is length more important than complexity?

Accepted Answer

Password strength = entropy = log₂(character_set_size ^ length). Increasing length multiplies entropy exponentially. Adding one character type (going from 62 to 95 chars) increases entropy by about 0.6 bits per character. Adding one character increases entropy by log₂(95) ≈ 6.6 bits. For the same effort, longer passwords are always stronger.

Question 3

What length should I use for different use cases?

Accepted Answer

User accounts: 16–20 characters. Service accounts and SSH keys: 32+ characters. Encryption passphrases (where humans type them occasionally): consider a 6-word passphrase instead of a random string — equal or higher entropy and more typeable. API keys and secrets: 32–64 alphanumeric characters (no symbols) to avoid encoding issues.

Question 4

What is the difference between random and cryptographically random?

Accepted Answer

A standard pseudo-random number generator (like Math.random()) is seeded from a predictable state and produces predictable sequences if the seed is known. A CSPRNG like crypto.getRandomValues() uses hardware entropy sources (CPU timing jitter, OS entropy pools) to produce values that cannot be predicted even with knowledge of previous outputs. Always use CSPRNG for security-sensitive generation.

Password Generator