FlowingDev

Passwords, explained: the digital key that's either a twig or a bank vault door

Learn how strong random passwords are created, why they're crucial for security, and how entropy and character sets turn gibberish into a digital fortress.

Try the tool: Password Generator

In one sentence

A password generator creates a string of characters so random that it's practically impossible for a computer to guess it, even with billions of tries per second.

The problem it solves

Humans are walking, talking, pattern-making machines. We're great at finding shortcuts, seeing faces in clouds, and remembering melodies. We are, however, absolutely terrible at creating randomness.

When we're asked to create a password, our brains default to what they know: names of pets (fluffy1), important dates (MomBday1965!), favorite sports teams (GoPackGo2024), or keyboard patterns (qwerty12345). We think we're being clever by swapping an o for a 0 or adding an exclamation mark at the end, but we're just following a slightly more complex, but still predictable, pattern.

This was fine in the early days of computing. But as processing power exploded, attackers automated the guessing game. They built tools to try every word in the dictionary (a "dictionary attack"). Then they added numbers, common substitutions, and special characters. Today, a modern GPU can make billions of guesses per second. A password like P@ssw0rd1! might look complex to a human, but to a computer, it's a low-hanging fruit that can be guessed in minutes, if not seconds.

The problem a password generator solves is the "human brain" problem. It outsources the job of creating a secret key to a machine that has no biases, no favorite pet names, and no concept of what "looks random." It just follows mathematical principles to produce a string that is, for all practical purposes, pure noise—and that noise is a symphony to a security-conscious developer.

How it works under the hood

A good password generator isn't just smashing keys together. It's a careful, calculated process rooted in the mathematical concept of entropy. Think of it as a high-tech dice-rolling machine.

The Secret Ingredient: Entropy

In cryptography, entropy is a measure of unpredictability or randomness. High entropy means a value is very hard to guess; low entropy means it's predictable. Your birthday has low entropy. The result of 100 coin flips has high entropy.

A password generator needs a source of high-quality randomness to do its job. In a modern web browser, this source is typically the Web Crypto API, specifically a function like crypto.getRandomValues(). This isn't your granddad's Math.random(). Instead of using a simple, predictable algorithm, it taps into the operating system's entropy pool. This pool is a cauldron of chaos, stirred with unpredictable inputs like:

  • The precise timing of your mouse movements and clicks
  • The rhythm of your keyboard strokes
  • Noise from hardware devices (like the fan or hard drive)
  • Network packet timings

The browser uses this cryptographic-grade pseudo-random number generator (CSPRNG) to get a stream of numbers that are unpredictable enough for security purposes. This is the raw material for our password.

Building the Character Pool

Next, the generator defines the "alphabet" it can choose from. This isn't just A-Z. It's the complete set of characters you've allowed. A typical configuration looks like this:

  • Lowercase: abcdefghijklmnopqrstuvwxyz (26 chars)
  • Uppercase: ABCDEFGHIJKLMNOPQRSTUVWXYZ (26 chars)
  • Numbers: 0123456789 (10 chars)
  • Symbols: !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~ (32 chars)

If you enable all four sets, your character pool (N) has a size of 26 + 26 + 10 + 32 = 94 possible characters. The size of this pool is a critical factor in the final password's strength.

Rolling the Dice: The Algorithm

With a source of random numbers and a pool of characters, the process is surprisingly simple:

  1. Get a random number: Ask the CSPRNG for a random number between 0 and 93 (the total size of our character pool minus one).
  2. Pick a character: Use that number as an index to pick a character from the pool. For example, if the random number is 74, and character 74 in our pool is &, then & is the first character of our password.
  3. Repeat: Do this over and over again for the desired length (L) of the password.

A simplified JavaScript-ish example might look like this:

function generatePassword(length, characterPool) {
  let password = "";
  const poolSize = characterPool.length;

  // Get an array of random numbers in one go for efficiency
  const randomValues = new Uint32Array(length);
  window.crypto.getRandomValues(randomValues);

  for (let i = 0; i < length; i++) {
    // Use the random number to pick a character from the pool
    const randomIndex = randomValues[i] % poolSize;
    password += characterPool[randomIndex];
  }
  return password;
}

const allChars = "abc...XYZ...123...#$!..."; // Pool of 94 chars
const myStrongPassword = generatePassword(16, allChars);
// Result: something like "9k&vB$@p!Z*rE#wJ"

The key is ensuring a uniform distribution—every character in the pool must have an equal chance of being selected for every position in the password.

Measuring Strength: Bits of Entropy

So, how strong is the result? We measure it in "bits of entropy." The formula is log₂(Total Combinations). The total number of combinations is the character pool size (N) raised to the power of the password length (L), or N^L.

The formula for bits of entropy is: H = L * log₂(N)

Let's see how this plays out.

Length (L) Character Set (N) Combinations (N^L) Bits of Entropy (H) Time to Crack (at 10¹² guesses/sec)
8 Lowercase only (26) 208 billion ~37.6 Milliseconds
8 All chars (94) 6 quadrillion ~52.4 Minutes
12 All chars (94) 4.7 x 10²³ ~78.7 Thousands of years
16 All chars (94) 3.7 x 10³¹ ~104.9 Trillions of years
24 All chars (94) 2.3 x 10⁴⁷ ~157.3 Effectively forever

As you can see, every character you add to the length doesn't just add strength—it multiplies it. This exponential growth is why a 16-character password isn't just twice as strong as an 8-character one; it's sextillions of times stronger. This is the mathematical backbone of password security.

Real-world stories

The "Password123" Cascade

A junior dev, let's call her Alex, was juggling a dozen services for a new project: GitHub, a cloud server provider, a database service, and several SaaS monitoring tools. To keep things simple, she used a password she could remember: ProjectName2023!. It felt secure enough. One day, the obscure forum-software-as-a-service she'd signed up for to track a bug announced a data breach. Their user database, including hashed passwords, was leaked. Unfortunately, they used a weak hashing algorithm, and within hours, crackers had reversed the hashes into plain text. Attackers then ran automated scripts, trying the leaked email:password combos on major services. They hit the jackpot with Alex's account. Her ProjectName2023! password gave them access to her cloud provider and GitHub repo. They copied the source code and customer data, then wiped the servers.

Lesson: Password reuse is a ticking time bomb. A breach anywhere becomes a breach everywhere. Every service needs a unique, randomly generated password.

The Brute-Force That Bounced

A sysadmin named Ben was hardening a new public-facing SSH server. This server was a tempting target, and he knew it would be scanned by bots the minute it went live. For the root user account (which he planned to disable for external login anyway), he didn't even try to think of a password. He generated a 32-character string of complete gibberish using all character sets: something like q#8v...G@z7. A week later, curious, he inspected the server's authentication logs. He found a horrifying sight: millions of failed login attempts from IP addresses all over the world. The bots were running a relentless brute-force attack, trying common passwords, dictionary words, and sequential characters. But against his 32-character fortress, they were like throwing pebbles at a mountain. They never even got close.

Lesson: Your first line of defense against automated, indiscriminate attacks is a password so complex and long that brute-forcing it is mathematically infeasible.

The Pen-Tester's "Easy Win"

Maria, a penetration tester, was hired to assess a mid-sized company's security. She started with "social engineering" and reconnaissance. While walking through the office on a guided tour, she discreetly observed people's workspaces. Tucked away on the side of one monitor was a Post-it note with Winter2024$. It belonged to someone in accounting. This password followed the classic "human" pattern: a common word, the current season/year, and a symbol at the end. It was a password designed to meet a policy (Must include one capital, one number, one symbol) while still being memorable. For Maria, it was an open door. She used it to log into the company's financial software, proving she could have accessed and manipulated sensitive data.

Lesson: Even when following a password policy, humans create predictable passwords. True randomness from a generator removes the human element, which is often the weakest link.

Common mistakes and traps

  • Trusting a sketchy generator. Be wary of random websites that offer password generation. A malicious site could be logging every password it creates. Stick to reputable, open-source tools or those that run entirely in your browser, where the code can't phone home.
  • Sacrificing randomness for memorability. If you generate a password and then "tweak" it to be easier to remember, you've undone the entire point. You've just re-injected the predictable human pattern that attackers exploit.
  • Ignoring the character set. A 20-character password made of only numbers (27182818284590452353) is vastly weaker than a 12-character password using letters, numbers, and symbols. The size of the character pool (N) is a powerful multiplier for strength.
  • Storing the generated password insecurely. Generating 4tG!p$z#qR@... is step one. Step two is storing it securely. Writing it on a Post-it note, saving it in passwords.txt on your desktop, or emailing it to yourself defeats the purpose. Use a trusted password manager.
  • Reusing your one "unbreakable" password. You generate a fantastic, 25-character password. You're so proud of it, you use it for your email, your bank, and your social media. The moment any one of those services is breached, your "unbreakable" key is in the hands of attackers, and all your accounts are vulnerable.

Why it belongs on your radar

If you write code, you manage secrets. Period. Whether it's a database connection string, an API key for a third-party service, a server login, or the default admin account for the app you're building, you are constantly creating and handling digital keys.

A developer should reach for a password generator whenever they need to create a secret that another machine might try to guess. The human brain is for logic, creativity, and problem-solving. It is not for generating cryptographic-grade random strings. By understanding and using password generators correctly, you replace a major human weakness with a mathematical certainty. It is one of the simplest and most effective security practices you can adopt. It's not just about protecting your own accounts; it's about building secure systems for your users from the ground up.

Go deeper

Theory done. Time to get your hands dirty — 100% in your browser.

Try the tool: Password Generator