In digital security, password strength is not just about length; it is about "entropy"—the mathematical measure of randomness. To protect accounts from brute-force dictionary attacks, understanding how to generate high-entropy passwords offline is critical.
1. Why Math.random() is Vulnerable
Many simple password tools use the standard Javascript Math.random() function. This is a massive security risk. Math.random() is a pseudo-random number generator (PRNG) that relies on predictable mathematical equations. If an attacker discovers the seed value or past outputs, they can predict every future password generated by that system.
2. Cryptographically Secure Pseudo-Random Generators (CSPRNG)
PDFscaler uses the Web Crypto API (window.crypto.getRandomValues). A CSPRNG draws randomness directly from system entropy sources (such as hardware noise, keystroke delays, and system temperatures). This makes outputs mathematically unpredictable, ensuring your passwords meet strict security audits.
3. Calculating Password Entropy
We measure password strength in bits of entropy using the formula:
E = L * log2(R)
Where L is password length and R is the character pool size (e.g. 26 lowercase + 26 uppercase + 10 digits + 32 special symbols = 94). A 16-character password with special characters yields over 100 bits of entropy, which would take modern supercomputers billions of years to crack. Run our Password Generator completely offline to keep your credentials safe.