Password Generator

Random-generation method and entropy assumptions

The generator builds passwords from the character sets selected in the interface and uses the browser’s cryptographic random source. Length is the strongest general control when choices are uniformly random. The displayed strength estimate is conditional on the selected alphabet and does not account for how a service stores passwords or whether a generated value is later reused.

Methodology

1. Random values come from Web Crypto rather than Math.random.
2. Characters are selected from the enabled alphabet with rejection sampling where needed to avoid modulo bias.
3. Required character-set options are checked so the result does not accidentally omit a selected category.
4. Generation occurs locally in the browser and the page does not transmit or retain the produced password.

Worked review example

A 20-character password drawn uniformly from upper- and lowercase letters plus digits has a much larger search space than a short human pattern with substitutions. Some websites restrict symbols or maximum length, so configure the generator to match the service’s documented rules. Store each generated password in a trusted password manager rather than a note or reused template.

Test coverage and expected behavior

Test coverage includes minimum and maximum lengths, each character-set combination, excluded ambiguous characters, repeated generation, and the guarantee that selected categories appear. Randomness cannot be certified from a small visual sample, so implementation review matters more than apparent variety.

Decision checklist before using the output

Set requirements from the destination service before generating. Prefer the longest length the service reliably accepts, keep all permitted character groups enabled, and avoid manual edits that introduce a memorable pattern. Generate a unique value for each account and transfer it directly into a trusted password manager. Confirm that the saved entry can autofill and that account recovery and multi-factor authentication are configured before discarding temporary access. If a site rejects certain symbols, adjust the alphabet rather than shortening the password. Never send generated credentials through ordinary email or reuse them in test and production environments. The page cannot protect a value from malware, clipboard synchronization, screenshots, browser extensions, or shoulder surfing. For service accounts and API access, use the platform’s secret-management and rotation features instead of treating a human password generator as the complete credential lifecycle.

Important limitations

• A compromised device or browser can expose generated secrets.
• Clipboard history and screen recording can retain copied passwords.
• Website-specific restrictions can reduce the available alphabet.
• Generation does not check whether a password appears in a breach corpus.

Sources and specifications

These references define the relevant format or browser behavior. They do not endorse WordCaseFix.

• Web Cryptography API
• NIST Digital Identity Guidelines

Last reviewed: August 6, 2026