Password Generator
Generate random strings or passphrases using the browser's cryptographic random source, with the real entropy shown for each.
Where the entropy figure comes from
For a random string it is length x log2(alphabet size). For a
passphrase it is words x log2(wordlist size). Both assume an attacker
knows exactly how the secret was generated, which is the only assumption worth
making, and neither depends on the result looking complicated.
Randomness comes from crypto.getRandomValues, and selection uses
rejection sampling rather than a modulo, so every character and every word is
equally likely. A plain % alphabet.length subtly favours the earlier
characters, which is a small bias but a free one to avoid.
The wordlist here is 256 short common words, so each word contributes exactly 8 bits. Five words is 40 bits, which is fine for a throwaway but not for anything that matters. For a password you have to type and remember, seven or more words is the honest minimum. Nothing generated here is stored or transmitted.