Cryptographic Password & Passphrase Studio
Generate automated guessing resistant random passwords and memorable multi-word Diceware passphrases using your operating system's cryptographic entropy pool. Includes live bit-entropy and offline GPU safety estimation.
Cryptographic Strength Audit
window.crypto.getRandomValues(new Uint32Array(1)) with rejection sampling to eliminate modulo
bias.
Why `window.crypto.getRandomValues()` Matters for Password Security
Many amateur password scripts rely on JavaScript's built-in Math.random() function. However,
Math.random() is a non-cryptographic pseudo-random number generator (xorshift128+) seeded from
predictable internal timers; if an unauthorized party knows the approximate millisecond a password was
generated, they can reconstruct the internal state.
GPDesk uses the W3C Web Cryptography API (window.crypto.getRandomValues), which
taps directly into your operating system's kernel entropy pool (/dev/urandom on
Linux/macOS/Android, BCryptGenRandom on Windows, and Secure Enclave RNG on iOS). Furthermore, we
apply rejection sampling rather than simple modulo division (rand % pool.length)
so that every character in the alphabet has a mathematically uniform probability of selection.
When to Use Random Passwords vs. Diceware Passphrases
- Random Character Passwords (20+ chars, ~125 bits): Ideal when saved inside a password manager (Bitwarden, 1Password, KeePassXC, Apple Passwords) where you never have to type the password by hand.
- Multi-Word Passphrases (5–6 words, ~65–80 bits): Ideal for your master vault password, laptop disk encryption (BitLocker / FileVault / LUKS), or Wi-Fi password that you must memorize and type on mobile keyboards.
Password Generator – Frequently Asked Questions
How many bits of entropy do I actually need in 2026?
For online accounts protected by rate limiting, 72+ bits of entropy is strong. For offline-vulnerable targets (like a password-protected ZIP/PDF or password manager master key), aim for at least 100+ bits of entropy so even nation-state GPU clusters cannot automated guessing it.
Are generated passwords ever saved in browser history or cookies?
Never. The generated string lives only inside a DOM text node in volatile memory and is overwritten the instant you click Regenerate or close the tab.
Need Help or Have a Question? Send Us an Email
Write your message below and click Send via Gmail to open Gmail with your message ready to send to [email protected].