Why should I never use `Math.random()` to generate passwords?

`Math.random()` uses pseudo-random algorithms (such as xorshift128+) whose seeds can be reverse-engineered by attackers. Web Crypto CSPRNG uses true OS hardware entropy.

What is a strong Password Entropy score?

Entropy over 60 bits is considered strong for standard accounts, while 80+ bits provides military-grade resistance against offline GPU brute-force cracking clusters.

What are the odds of two people generating the exact same UUID v4?

With 122 bits of randomness, you would need to generate 1 billion UUIDs every second for approximately 85 years to reach a 50% chance of a single collision.

What is the difference between a UUID and a GUID?

GUID (Globally Unique Identifier) is Microsoft's term for UUID (Universally Unique Identifier). Both conform to the RFC 4122 specification and represent 128-bit identifiers.

Are generated passwords ever logged or transmitted to your servers?

No. All password and UUID generation is executed 100% locally in your browser sandbox using native `window.crypto` APIs with zero network activity.

SEO & Webmaster Essential

Secure Password & UUID v4 Generator

Generate cryptographically secure random passwords with entropy ratings, memorable passphrases, and bulk UUID v4 identifiers via Web Crypto.

Cryptographically secure pseudo-random number generator (CSPRNG) via `crypto.getRandomValues`

Customizable password complexity: length (8-128 chars), uppercase, lowercase, numbers, and symbols

Real-time Password Entropy calculator (bits of entropy) and brute-force crack time estimates

Bulk UUID v4 / GUID generation (1 to 500 identifiers) with uppercase and hyphen options

Memorable Diceware passphrase generator mode for human-friendly security

The Cryptography of Randomness: Passwords, Entropy, and UUID v4 Standards

In-depth specifications, architectural mechanics, real-world code implementations, and industry best practices.

Pseudo-Random vs Cryptographically Secure Random (CSPRNG)

Standard JavaScript Math.random() is a pseudo-random number generator (PRNG) that produces predictable sequences derived from internal seeds. It is strictly forbidden for security keys or password generation. In contrast, the Web Cryptography API (crypto.getRandomValues) accesses system-level entropy pools (hardware noise, disk timing, interrupt intervals), producing cryptographically secure, unpredictable random bit streams.

Implementation Example

// ❌ Insecure PRNG (Predictable - Never use for security)
const insecureRand = Math.random();

// ✅ Cryptographically Secure CSPRNG via Web Crypto
const secureArray = new Uint32Array(1);
window.crypto.getRandomValues(secureArray);
const secureRandomFloat = secureArray[0] / (0xffffffff + 1);

Calculating Password Entropy: Bits of Security and Crack Resistance

Password entropy measures the unpredictability of a password in bits: E = L * log2(R), where L is the character length and R is the size of the character pool (e.g., lowercase + uppercase + digits + symbols = 94 characters). A 16-character password chosen from a 94-character pool yields ~105 bits of entropy, requiring billions of years to brute force on modern GPU supercomputer clusters.

Implementation Example

// Calculating Password Entropy in TypeScript
function calculateEntropy(password: string): number {
  let poolSize = 0;
  if (/[a-z]/.test(password)) poolSize += 26;
  if (/[A-Z]/.test(password)) poolSize += 26;
  if (/\d/.test(password)) poolSize += 10;
  if (/[^A-Za-z0-9]/.test(password)) poolSize += 32;
  if (poolSize === 0) return 0;
  return Math.floor(password.length * Math.log2(poolSize));
}

Anatomy of RFC 4122 UUID Version 4 (GUID)

A UUID (Universally Unique Identifier) is a 128-bit identifier formatted as 32 hexadecimal characters across five groups: xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx. In Version 4 UUIDs, 122 bits are cryptographically random, 4 bits specify the version (0100 for v4), and 2 bits specify the variant (10 for RFC 4122). The probability of generating a duplicate UUID v4 is negligible (1 in 2^122).

Implementation Example

// Native browser UUID v4 Generation
const uniqueId = crypto.randomUUID();
// => "f47ac10b-58cc-4372-a567-0e02b2c3d479"

NIST SP 800-63B Guidelines: Passphrases vs Complex Strings

Modern guidelines from the National Institute of Standards and Technology (NIST SP 800-63B) recommend long multi-word passphrases (e.g., "correct-horse-battery-staple") over short, arbitrarily complex strings. Passphrases provide equal or superior entropy while remaining easily memorable for humans without writing them down.

Implementation Example

// Diceware Passphrase Generation concept
const wordList = ['galaxy', 'harbor', 'vintage', 'falcon', 'timber', 'summit'];
// 4 randomly selected words => ~52 bits of entropy + high memorability

Knowledge Base & Clarifications