Cryptographically Secure Password Generation: Math, Entropy, and Web Crypto API

The Mathematics of Password Entropy

In information theory, entropy (measured in bits) quantifies the amount of uncertainty or randomness in a generated secret. The higher the entropy score of a password, the more trial-and-error guesses an attacker must execute to brute-force the credential.

The mathematical equation for calculating the entropy ($E$) of a password of length $L$ selected uniformly from a character pool of size $N$ is:

Why Math.random() is Insecure for Security Applications

Standard JavaScript Math.random() uses pseudo-random number generators (PRNGs) like the xorshift128+ algorithm. These algorithms are designed for statistical performance in graphics and simulations, not cryptographic defense. An observer who records a small sequence of Math.random() outputs can reverse-engineer the internal generator state and predict every future password generated.

Using the Browser's Cryptographically Secure CSPRNG

To guarantee non-deterministic randomness, modern secure web tools use crypto.getRandomValues() from the Web Cryptography API. This interface taps into hardware-level operating system entropy (such as CPU thermal noise and interrupt timings):

// Cryptographically secure random character selection
function getSecureRandomByte(max) {
  const array = new Uint32Array(1);
  window.crypto.getRandomValues(array);
  return array[0] % max;
}