Cryptographic Password Generation & Information Entropy (NIST SP 800-63B)
In cybersecurity engineering, passwords and pre-shared API keys serve as the primary barriers against unauthorized access, credential stuffing, and dictionary attacks. According to the NIST Special Publication 800-63B (Digital Identity Guidelines), the cryptographic resilience of a secret is determined primarily by its length and the entropy of the generating mechanism.
1. The Difference Between Math.random() and Web Crypto API
- Math.random(): Uses a pseudo-random number generator (PRNG) such as xoshiro128+ or XorShift. These algorithms are fast for simulations but mathematically deterministic; given a small sample of output, an attacker can reconstruct the internal state and predict all future outputs.
- window.crypto.getRandomValues(): A Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). It draws true entropy from hardware events (system timing, CPU thermal noise, hardware interrupts) provided by the host operating system kernel (
/dev/urandomon Unix,BCryptGenRandomon Windows), guaranteeing non-determinism.
2. Shannon Entropy & Password Cracking Times
The mathematical entropy $H$ in bits is calculated as:
H = L × log2(N)
Where $L$ is the character length and $N$ is the character pool size:
- Only numbers (0-9): $N = 10$ → ~3.32 bits per character.
- Upper + Lower (a-z, A-Z): $N = 52$ → ~5.70 bits per character.
- Full set (letters, digits, symbols): $N \approx 94$ → ~6.55 bits per character.
A 16-character full-set password provides over 100 bits of entropy ($2^{100}$ possible permutations), making offline brute-force cracking mathematically infeasible with current supercomputers.
Frequently Asked Questions (FAQ)
How are passwords generated cryptographically securely in the browser?+
This generator uses window.crypto.getRandomValues(), the W3C standard Web Cryptography API. Unlike standard Math.random() (which uses predictable pseudo-random seeds), crypto.getRandomValues() taps into hardware entropy sources provided by your operating system, preventing brute-force seed recovery.
What is password entropy and how many bits are recommended for safety?+
Entropy (measured in bits) quantifies the unpredictability of a password. A 16-character password combining uppercase, lowercase, numbers, and symbols delivers ~105 bits of entropy, which would require modern GPU clusters trillions of years to brute-force.
Is the generated password stored, logged, or sent over the internet?+
Never. The password generation algorithm runs 100% locally in your client's RAM. No network requests are made, and your generated credentials disappear the moment you navigate away or refresh.