Cryptographically Secure Randomness vs. Pseudo-Random Number Generators
Standard JavaScript Math.random() relies on pseudo-random number algorithms (such as xorshift128+) designed for speed rather than cryptographic unpredictability. Because PRNG internal state can be reconstructed from observed sequence outputs, passwords generated via Math.random() are fundamentally vulnerable to reverse-engineering and statistical prediction attacks.
This tool utilizes window.crypto.getRandomValues(), which interfaces directly with the host operating system's cryptographic random number generator (such as /dev/urandom on Linux and macOS or CryptGenRandom / BCryptGenRandom on Windows). This guarantees true cryptographically secure pseudo-randomness (CSPRNG) with maximum information entropy.
Information Entropy Calculation (Shannon Entropy)
Password strength is mathematically measured in bits of entropy using Shannon's entropy formula:
- L = Password length in characters
- R = Size of the available character pool (e.g. 90 unique characters when uppercase, lowercase, numbers, and symbols are enabled)
A 20-character password drawn from a pool of 90 characters delivers approximately 130 bits of entropy, requiring an astronomical 2130 brute-force attempts to exhaust the keyspace—far exceeding modern supercomputing capabilities.
Guaranteed Character Representation and Unbiased Shuffling
Many simplistic password generators pick random characters from a concatenated pool, which creates a probabilistic risk that a required character class (such as special symbols or digits) might be omitted in a specific password.
Our generator enforces strict representation: at least one character is selected directly from each active class, remaining positions are populated uniformly from the combined pool using rejection sampling to eliminate modulo bias, and the entire character array undergoes an unbiased cryptographic Fisher-Yates shuffle.
Zero-Retention & Zero-Backend Privacy Architecture
In accordance with strict zero-knowledge security standards:
- 100% Client-Side: All computations execute strictly within your local browser JavaScript engine. No passwords, seeds, or parameters are ever sent to an external server.
- Zero Persistence: Generated passwords exist solely in ephemeral memory and are never written to
localStorage,sessionStorage, cookies, or indexed databases. - Zero Auto-Copy: Passwords are never placed into your system clipboard without an explicit user click on the Copy action button, preventing clipboard snooping attacks.
Frequently Asked Questions
- 生成的密码会被上传到服务器或第三方服务吗？
- 绝对不会。所有密码生成均在您本地浏览器的运行时内存中完成，调用的是底层的 window.crypto.getRandomValues API，完全断网亦可正常运行。
- 为什么不使用 Math.random()？
- Math.random() 属于伪随机数发生器（如 xorshift128+），其输出序列在数学上是可被算法预测的，严禁用于密码安全场景。window.crypto 则直接从操作系统内核熵池采集真随机数。
- 生成的密码会被保存到浏览器的 localStorage 吗？
- 绝不保存。为遵循零残留隐私安全原则，密码仅保存在 React 临时组件状态中，刷新页面即销毁。本地持久化的仅有字符长度、是否包含符号等非敏感偏好。
- 香农信息熵（Entropy）是如何计算的？
- 计算公式为：Entropy = 密码长度 × log2(字符池大小)。例如 20 位包含大小写、数字与符号的密码，信息熵超过 128 比特，相当于需要 2^128 次尝试才能穷举破解。