Question 1

Is this password generator actually secure?

Accepted Answer

Yes. All randomness comes exclusively from crypto.getRandomValues — the browser's CSPRNG seeded by the OS (e.g. /dev/urandom on Linux, BCryptGenRandom on Windows). This is the same entropy source used in TLS handshakes. Math.random() is never called anywhere in the generation logic.

Question 2

Do my passwords get sent to a server?

Accepted Answer

Never. The entire tool runs inside your browser tab as client-side JavaScript. No password, no list item, and no configuration is transmitted over any network. Nothing is written to localStorage, sessionStorage, cookies, or IndexedDB — state exists only in browser memory for the duration of your session.

Question 3

What does "Exclude Ambiguous Characters" do?

Accepted Answer

When enabled, the characters 0 (zero), O (uppercase letter O), l (lowercase letter L), 1 (one), and I (uppercase letter I) are removed from the active character set before generation. This prevents confusion when reading or typing passwords manually, especially in fixed-width fonts.

Question 4

How is password entropy calculated?

Accepted Answer

Entropy is computed as floor(length × log2(charsetSize)), where charsetSize is the count of unique characters in the active set after applying the Exclude Ambiguous filter. Higher entropy means a larger search space and a harder-to-crack password. The tool displays a real-time strength label: Weak (<40 bits), Fair (40–59 bits), Strong (60–79 bits), or Very Strong (80+ bits).

Question 5

How does the Shuffle Generator work for a single line of text?

Accepted Answer

When the input contains only one non-empty line, the tool treats each character as an individual item and shuffles them using the Fisher-Yates algorithm with crypto.getRandomValues. This lets you randomize the characters of a word or short string. For multi-line input, each line is treated as one item and the lines are shuffled.

Question 6

Can I use this tool offline?

Accepted Answer

Yes. Once the page has loaded, all password generation and shuffle operations work entirely offline. No external libraries are fetched at runtime — only the browser's built-in crypto.getRandomValues API is used.

Question 7

What is the maximum password length supported?

Accepted Answer

The tool supports password lengths from 8 to 128 characters inclusive. Values outside this range are automatically clamped — entering 200 will produce a 128-character password, and entering 4 will produce an 8-character password.

Password & Shuffle Generator

Cryptographic Password Generation

Fisher-Yates List Shuffler

Entropy & Strength Feedback

How the Password & Shuffle Generator Works

Why Client-Side Matters for Passwords

Frequently Asked Questions

Built for Daily Developer Workflows