Password Generator

This tool calls crypto.getRandomValues(new Uint32Array(length)) to fill an array with cryptographically random 32-bit integers, then maps each integer to a character by taking value % charset.length. The Web Crypto API is seeded by the operating system — on macOS/Linux via /dev/urandom, on Windows via BCryptGenRandom — and is the same source used by TLS and SSH key generation.

const buf = new Uint32Array(length);
crypto.getRandomValues(buf);           // OS-seeded CSPRNG
const pwd = Array.from(buf)
  .map(v => charset[v % charset.length])
  .join("");

Modulo bias: When the charset length is not a power of 2, values near the top of the Uint32 range are slightly more likely to map to lower charset indices. For a charset of 76 symbols this bias is less than 0.002% — negligible for password generation purposes. A rejection-sampling approach would eliminate it entirely but adds complexity without meaningful security benefit for this use case.

Entropy formula: bits = length × log2(charset_size). A 16-character password over a 76-character charset yields approximately 16 × 6.25 = 100 bits — well beyond the 80-bit threshold considered computationally infeasible to brute-force with current hardware.