regula.tools
100% Client-SideGenerators

Cryptographically Secure Password & Passphrase Generator

Engineered to meet NIST SP 800-63B standards, this utility leverages your browser’s cryptographically secure pseudo-random number generator (window.crypto.getRandomValues). All credentials are generated strictly in memory and are never persisted in cookies, local storage, or transmitted across the network.

Loading workspace...

#How to Use This Tool

1Select your preferred mode: Character permutation or Memorable passphrase (Diceware).
2Customize parameters such as length, character sets (uppercase, lowercase, numbers, symbols), or word count.
3Toggle ambiguous character exclusion if credentials will be manually transcribed.
4Copy the generated credential directly to your clipboard or generate in bulk.

#Mathematical Formula & Standards

Entropy quantifies password unpredictability and is measured in bits using Shannon entropy: E = L × log2(R), where L is password length and R is the character pool size. For Diceware passphrases, entropy is computed as E = W × log2(N), where W is the word count and N is the dictionary wordlist size (~1,296 words). A minimum of 64 bits is recommended for routine accounts, while 80+ bits is required for high-assurance credentials.

#Edge Cases & Technical Considerations

Ambiguous Glyphs (0 vs O, 1 vs l)

Certain sans-serif and display fonts render uppercase O and number 0, or uppercase I and lowercase l, almost identically. Enabling "Exclude Ambiguous" strips these characters to prevent transcription errors on physical paperwork or mobile devices.

Browser CSPRNG vs Pseudo-Randomness

Standard Math.random() implementations rely on deterministic PRNG algorithms (such as XorShift128+) which can be reversed after observing several consecutive outputs. This tool strictly mandates window.crypto.getRandomValues() to sample hardware-seeded OS entropy.

#Frequently Asked Questions

Q:Are generated passwords saved anywhere or sent to a server?

No. The generation algorithm runs 100% on-device via client-side JavaScript. Generated values are held only in temporary component state and are wiped immediately upon closing or refreshing the tab.

Q:What makes a passphrase more secure than a random password?

Passphrases composed of multiple random dictionary words (e.g. "correct-horse-battery-staple") offer high mathematical entropy while remaining human-memorable, drastically reducing the risk of users writing credentials down insecurely.

Q:What is NIST SP 800-63B guidance on password complexity?

NIST advises prioritizing length over arbitrary composition rules (such as forcing periodic special character changes). A long passphrase or high-entropy random string resists offline dictionary and brute-force attacks far more effectively than short, complex strings.

← Back to Generators HubReturn to Catalog ↑