Password Generator

A small browser password generator: pick a length and which character sets to use, and it builds a random password using the Web Crypto API. No build step, no dependencies, no network requests — three static files and nothing else.

Your choices (length and selected character sets) are remembered in localStorage between visits. Generated passwords are never stored or sent anywhere.

Entropy source

Passwords are generated with crypto.getRandomValues(), the browser's cryptographically secure random number generator. Math.random() is not used anywhere in this project — it is a fast non-cryptographic PRNG, its output is predictable from previous values, and it must never be used to generate secrets.

Each character is picked with rejection sampling rather than a plain % charset.length:

const limit = Math.floor(4294967296 / range) * range;
const buffer = new Uint32Array(1);

do {
    crypto.getRandomValues(buffer);
} while (buffer[0] >= limit);

return buffer[0] % range;

2³² is not an exact multiple of the alphabet size, so taking the modulo of a raw 32-bit value would make the first few characters of the set slightly more likely than the rest. Discarding the values above the largest exact multiple removes that bias, and every character in the set becomes equally likely. With the full 91-character alphabet a value is rejected roughly once every 58 million draws, so the loop virtually never runs twice.

Character sets and entropy

Sets enabled	Alphabet	Bits per character
Lowercase only	26	4.70
Upper + lowercase	52	5.70
Upper + lowercase + numbers	62	5.95
All four sets	91	6.51

Multiply by the length for total entropy: the default 12 characters over the full alphabet gives about 78 bits, and the 50-character maximum gives about 325 bits.

The special characters available are:

.!?;:'@#$%^&*_-+=~`|/(){}[]<>

Usage

1. Set a Length between 1 and 50.
2. Tick the character sets you want: capitals, lowercase, numbers, special.
3. Press Generate new Password.
4. Press the copy button to put the password on your clipboard.

On first load no character set is selected yet, so the password box stays empty until you tick at least one. After that, your settings are restored on every visit.

Running it locally

Clone the repository and serve it over localhost:

git clone https://github.com/AdriaBC06/Secure-Password-Generator.git
cd Secure-Password-Generator
python3 -m http.server 8000

Then open http://localhost:8000.

Opening index.html directly with a file:// URL also generates passwords correctly — crypto.getRandomValues() does not require a secure context — but the copy button may not work, because navigator.clipboard is only available in a secure context. localhost counts as one, so the local server above avoids the problem.

Project structure

.
├── index.html   # Markup and controls
├── script.js    # Generation, rejection sampling, localStorage persistence
├── styles.css   # Styling
└── resources/
    └── copy.svg # Copy button icon

Limitations

• The generator does not guarantee that every selected set appears in the output. With a short length, a password may happen to contain no digit or no special character even if those boxes are ticked.
• There is no strength meter and no check against known-breached password lists.
• Passwords live only in the page and in your clipboard. There is no history and nothing is persisted.

License

GNU General Public License v3.0 or later. See LICENSE.