Question 1

Is this password generator secure?

Accepted Answer

Yes. It uses crypto.getRandomValues(), the Web Crypto API seeded by the operating system's entropy source. This is cryptographically secure and not predictable, unlike Math.random().

Question 2

Are generated passwords stored or sent to a server?

Accepted Answer

No. All generation runs client-side in your browser. No password ever leaves your device. The history is held only in memory and is cleared when you close or refresh the page.

Question 3

How long should a password be?

Accepted Answer

For most accounts, 16+ characters. For a password manager master password, 20+ characters with symbols. NIST 2024 guidelines recommend prioritising length over complexity rules.

Question 4

What is password entropy?

Accepted Answer

Entropy measures unpredictability in bits. It is calculated as log₂(character_pool_size ^ password_length). 40 bits is fair, 60 is good, 80+ is very strong. Each additional bit doubles the number of guesses needed to crack the password.

Question 5

What is a passphrase and is it secure?

Accepted Answer

A passphrase is a sequence of random words (e.g., Marble-Forest-Zephyr-Knight42) drawn from the EFF's 7,776-word list. A 4-word passphrase achieves approximately 52 bits of entropy and a 5-word passphrase about 65 bits — easier to remember than random characters and recommended by NIST for human-memorised credentials. Use 5 or more words for important accounts.