Most password generators on the web have a fundamental weakness: they use Math.random(), which is not cryptographically secure. A determined attacker can predict the output of Math.random() with enough samples, making generated passwords theoretically predictable.

This guide explains what makes a password truly secure, how to generate one using the NexaTools Password Generator, and how to evaluate the strength of any password.

What Makes a Password Strong?§

Password strength is measured in bits of entropy. Each bit doubles the number of possible passwords an attacker would need to try. A password with 64 bits of entropy requires 2^64 guesses — trillions of years of brute forcing at current hardware speeds.

Entropy depends on two factors:

  • Character set size — lowercase letters (26), uppercase (26), digits (10), symbols (32)
  • Password length — longer passwords are exponentially harder to crack

How the NexaTools Password Generator Works§

Unlike most online generators, the NexaTools Password Generator uses the Web Crypto API's crypto.getRandomValues() — the same cryptographically secure random number generator that browsers use for TLS key generation and encryption. This ensures:

  • No predictable sequence — each password is truly random
  • No server involvement — the password never leaves your browser
  • No logging — no record of generated passwords is stored anywhere
  • Default (16 chars, all types) — 103 bits of entropy. Secure for most purposes, including password managers
  • Maximum security (32 chars, all types) — 207 bits of entropy. Overkill for any practical purpose, but useful for master passwords
  • PIN-style (6 digits) — 20 bits of entropy. Suitable only for temporary or low-security use
  • Memorable (12 chars, mixed case + digits) — 71 bits of entropy. Balanced for memorability and security
  • Exclude ambiguous characters — removes characters like 1, l, I, 0, O that are easily confused in fonts

Entropy Comparison§

How long does it take to crack a password at 10 billion guesses per second (estimated hashcat speed for SHA-256):

  • 8 characters, lowercase only: 0.5 seconds
  • 8 characters, all types: 8 hours
  • 12 characters, all types: 32,000 years
  • 16 characters, all types: 500 million years

The 16-character default password from the generator is effectively unbreakable by brute force.

Password Managers Are Essential§

No human can remember a 16-character random password. Use a password manager to store generated passwords. The 16-character default from the generator is designed to be stored in a password manager, not memorized.

Summary§

The NexaTools Password Generator creates cryptographically secure passwords using the Web Crypto API. At the default 16-character setting, your password is effectively unguessable by current and near-future hardware.