Documentation Hub

Educational Reference & Telemetry

Module Purpose

Secret Generator is an industrial-grade cryptographic key, password, and token generation vault. It creates cryptographically secure random sequences, API keys, JWT signing secrets, database credentials, SSH passphrases, and symmetric encryption keys tailored to strict entropy requirements. By utilizing hardware-level entropy sources exposed via the browser's operating system interface, it eliminates the predictable pseudo-random seeds common in software-only generators.

Security · DEV

Password Lab

Related: Build a Secure Home NAS or Media Server with a Raspberry Pi→
Reference Manual & Technical Spec

Password Lab — Overview & Engineering Principles

Secret Generator is an industrial-grade cryptographic key, password, and token generation vault. It creates cryptographically secure random sequences, API keys, JWT signing secrets, database credentials, SSH passphrases, and symmetric encryption keys tailored to strict entropy requirements. By utilizing hardware-level entropy sources exposed via the browser's operating system interface, it eliminates the predictable pseudo-random seeds common in software-only generators.

🛡️

Zero-Trust Client Execution

True cryptographic security requires a strict zero-trust client execution architecture. Traditional server-side password generators introduce a severe interception risk over transit and can log generated credentials in server access logs or memory caches. This vault executes 100% locally inside your browser sandbox using the W3C Web Cryptography API (`crypto.getRandomValues`), ensuring that generated secrets, seed phrases, and high-entropy credentials never touch network sockets, third-party APIs, or persistent disk storage.

Mathematical & Algorithmic Model

Shannon Information Entropy (Password Strength in Bits)
H = L × log₂(N)
HTotal Information Entropy in bits (Bits)
LPassword Length (number of generated characters)
NSize of character pool (e.g. 94 for full ASCII, 62 for alphanumeric, 16 for hex)

Measures the theoretical computational complexity required to exhaustively brute-force a generated credential assuming a uniform probability distribution.

CSPRNG Unbiased Uniform Mapping (Rejection Sampling)
P(char) = 1 / N (via rejection of byte values ≥ 256 - (256 % N))
CSPRNGCryptographically Secure Pseudorandom Number Generator (OS entropy pool)
NTarget character pool cardinality

Eliminates modulo bias when mapping raw 8-bit random bytes (0–255) onto non-power-of-two character pool sizes, preventing statistical character clustering.

Worked Practical Calculation Example

Generating a 128-bit Entropy API Secret Key for Backend OAuth2 Services

You are generating a secure backend API secret key for an enterprise microservice and need to ensure it exceeds the NIST SP 800-63B minimum entropy recommendations.

Step 1:Define character pool cardinality

Base entropy per character = log₂(94) ≈ 6.55458 bits per character.

Uppercase (26) + Lowercase (26) + Digits (10) + Symbols (32) -> Pool N = 94 ASCII characters
Step 2:Calculate minimum string length for 128-bit entropy target

A 20-character password from this pool yields 20 × 6.55458 = 131.09 bits of true entropy.

L = 128 / 6.55458 ≈ 19.53 -> Minimum Length = 20 characters
Step 3:Hardware Entropy Sampling via Web Cryptography API

Directly reads the underlying OS kernel entropy pool (/dev/urandom or Windows CryptoAPI).

crypto.getRandomValues(new Uint8Array(20)) with rejection sampling
Step 4:Calculate theoretical brute-force resistance at 100 Trillion hashes/second

Mathematically infeasible to compromise with current or near-future quantum/classical hardware.

2^131 / (10^14 hashes/sec × 3.15 × 10^7 sec/year) ≈ 8.6 × 10^17 Years
Final Computed Output:Generated Secret: 20-character credential with 131.1 bits of entropy (Surpasses NIST 128-bit security threshold).

Step-by-Step Operation Guide

  1. Select your target credential format: Alphanumeric Password, Cryptographic API Key, High-Entropy Passphrase, Hex/Base64 Token, or Custom Character Set.
  2. Configure your complexity parameters: character length (up to 128 characters), specific symbol inclusion, uppercase/lowercase constraints, and ambiguous character exclusions (e.g. 0/O, 1/l/I).
  3. Inspect the real-time Shannon entropy meter (bits of entropy) and estimated exhaustive brute-force attack resistance under modern GPU cluster capabilities.
  4. Click 'Generate' to refresh entropy buffers, or click 'Copy' to transfer the credential directly to your operating system clipboard without leaving a plaintext trail.

Technical Specification Matrix

Entropy EngineWeb Cryptography API (window.crypto.getRandomValues)
RNG Security StandardNIST SP 800-90A / FIPS 140-2 compliant OS entropy hooks
Character PoolsFull ASCII (94 chars), Alphanumeric (62), Hex (16), URL-Safe Base64 (64), Diceware Wordlists
Network Footprint0 bytes transferred (Fully Air-Gapped Operation)

Frequently Asked Questions & Edge Cases

Why is Math.random() considered a critical security vulnerability for passwords?▼
JavaScript's Math.random() uses algorithms like xoshiro128+ or v8:XorShift128+, which are fast deterministic pseudo-random number generators designed for graphics and simulations, not cryptographic security. An attacker who observes a small sequence of generated outputs (as few as 5 to 10 tokens) can completely reconstruct the internal seed state and predict all past and future outputs. Secret Generator strictly uses window.crypto.getRandomValues, which draws directly from kernel-level hardware entropy pools.
What is 'modulo bias' and how does this generator avoid it?▼
When mapping a random byte (0 to 255) to a 62-character alphanumeric pool using simple modulo (byte % 62), numbers 0 through 7 have 5 possible byte values (0, 62, 124, 186, 248), while numbers 8 through 61 have only 4 possible values. This creates a statistical skew where certain characters appear ~25% more frequently than others. Secret Generator uses rejection sampling, discarding any raw byte ≥ 248 and resampling, guaranteeing an exact, mathematically uniform probability for every character in the pool.
What length is recommended for production database and API credentials?▼
For human-remembered master credentials, a 5-to-6 word Diceware passphrase (~75 to 90 bits of entropy) is ideal for balancing memorability with brute-force resistance. For automated machine-to-machine tokens, database connection passwords, and JWT signing keys, NIST and OWASP recommend at least 128 bits of entropy (equivalent to a 20-character full-ASCII string, 22-character alphanumeric string, or 32-character hex token).
Are passphrases made of random words more secure than complex strings?▼
A passphrase consisting of 5 or 6 randomly chosen dictionary words from the EFF 7,776-word Diceware list provides ~65 to 78 bits of entropy while remaining easy for humans to type accurately without copying. For human-typed master passwords, passphrases reduce user error while resisting dictionary attacks, provided the words are selected with genuine cryptographic randomness rather than human intuition.
Does using special symbols like @ or # significantly increase password strength?▼
Expanding the character set from alphanumeric (62 chars, ~5.95 bits/char) to full ASCII with symbols (94 chars, ~6.55 bits/char) adds approximately 0.6 bits of entropy per character. However, increasing password length is far more effective: a 16-character alphanumeric password (95.2 bits) is vastly stronger than an 8-character password filled with complex symbols (52.4 bits), because length scales entropy exponentially.

Connected Knowledge Resources

📖
In-Depth GuideCryptographic Hash Functions and Data Integrity
📝
Lab ArticleWhy Client-Side Tools Are Safer for Secrets (Hashes, Passwords, JWTs)
Related Utilities
Hash Generator LabData TransformerURL Architect