How Random Password Generators Work

Not all randomness is equal. A good password generator relies on a cryptographically secure random number generator (CSPRNG), not the kind of randomness used for games or animations.

Ordinary vs cryptographic randomness

Programming languages offer simple random functions, such as Math.random() in JavaScript. They are fast and fine for shuffling a playlist, but they are not designed to be unpredictable to an attacker. In some cases their internal state can be reconstructed from outputs.

A CSPRNG draws on unpredictable inputs collected by the operating system and is designed so that future outputs cannot be predicted from past ones. Browsers expose one through the Web Crypto API as crypto.getRandomValues().

Avoiding modulo bias

A common mistake is to take a random number and use the remainder after division to pick a character:

index = randomNumber % characters.length

If the range of random numbers is not an exact multiple of the character count, some characters appear slightly more often. This is called modulo bias. The fix is rejection sampling: discard random values from the uneven top end of the range and draw again.

How our generator builds a password

The NS Tools Hub password generator works like this:

1. Builds a pool from the character types you selected.
2. Picks one character from each selected type, so every type is guaranteed to appear.
3. Fills the remaining length from the full pool using unbiased random numbers.
4. Shuffles the result with a Fisher-Yates shuffle that also uses the CSPRNG.

Everything runs in your browser. The password is never sent over the network, which removes the risk of interception or logging.

Can you trust an online generator?

Check that generation happens locally (the tool should work even if you disconnect after the page loads) and that the site uses HTTPS. For the highest assurance, generate passwords inside your password manager, which uses the same kind of randomness.

Frequently asked questions

Is it safe to use an online password generator?

Is it safe to use an online password generator? Yes, when generation happens locally in your browser with cryptographic randomness, as it does here. Nothing is sent or stored. Avoid generators that create passwords on a server.

Math.random vs crypto.getRandomValues: what is the difference?

In JavaScript, the Math.random vs crypto.getRandomValues difference is security. Math.random is fast but not designed to be unpredictable to attackers; crypto.getRandomValues uses the operating system's secure random source. Password generators must use the second.

Can I use it as an API key generator or secret key generator?

Yes. Set a length of 32 to 64 characters, letters and numbers only, and it works as an API key generator or secret key generator for app secrets. Store environment variable secrets in a secrets manager or .env file that is never committed to version control.

Can I generate multiple passwords at once?

Yes. The bulk password generator in the sidebar can generate multiple passwords at once (5, 10 or 20) with your current settings. Each one is a long random password. Turn on numbers for a random password with numbers, or turn on symbols for a password generator with symbols.