Developer
Jun 23, 2026
Why a Password Generator Using Math.random() Is Less Secure Than Its Length Suggests — Entropy, CSPRNG, and What to Check
A password generator using Math.random() is not cryptographically secure — a password's effective entropy is limited by the randomness quality of the generator, not just its length and character set. Here's what password entropy actually measures (bits of theoretical guessing difficulty), why crypto.getRandomValues() is categorically different from Math.random(), why length increases entropy faster than adding special characters, and how Diceware achieves verifiable physical randomness.