Password Generator Articles

Try the Password Generator
SMS and TOTP Can Both Be Phished in Real Time — Here's Which MFA Methods Are Actually Phishing-Resistant

SMS and TOTP Can Both Be Phished in Real Time — Here's Which MFA Methods Are Actually Phishing-Resistant

SMS OTP and TOTP are both vulnerable to real-time phishing (AiTM attacks relay codes before they expire) — hardware keys and passkeys are phishing-resistant because their response is cryptographically bound to the exact URL. Here's the MFA security spectrum from SMS to passkeys, the MFA fatigue (push bombing) attack that compromised Uber in 2022, why number matching prevents rubber-stamping push notifications, and why security questions aren't a genuine second factor.

Jul 10, 2026
Why a Password Generator Using Math.random() Is Less Secure Than Its Length Suggests — Entropy, CSPRNG, and What to Check

Why a Password Generator Using Math.random() Is Less Secure Than Its Length Suggests — Entropy, CSPRNG, and What to Check

A password generator using Math.random() is not cryptographically secure — a password's effective entropy is limited by the randomness quality of the generator, not just its length and character set. Here's what password entropy actually measures (bits of theoretical guessing difficulty), why crypto.getRandomValues() is categorically different from Math.random(), why length increases entropy faster than adding special characters, and how Diceware achieves verifiable physical randomness.

Jun 23, 2026
Why a Strong Password Isn't Enough: Credential Stuffing and the Case for Unique Passwords Everywhere

Why a Strong Password Isn't Enough: Credential Stuffing and the Case for Unique Passwords Everywhere

A password can be long, random, and never appear in any breach — and still get your account compromised, because the attack that actually breaks most accounts isn't guessing your password, it's trying a password that worked on a completely different site you used years ago. Here's how credential stuffing works, why password "strength" is irrelevant to this specific attack, and why a generator-plus-manager combination — making unique-per-site passwords practically achievable — directly closes this vector.

Jun 16, 2026
Passkeys: How FIDO2/WebAuthn Works and Why It's Replacing Passwords

Passkeys: How FIDO2/WebAuthn Works and Why It's Replacing Passwords

Passkeys store a private key on your device and register only the public key with the website — there's nothing to phish, breach, or reuse. Here's how FIDO2/WebAuthn registration and authentication work, the difference between platform passkeys (iCloud, Google) and hardware keys, and the current state of passkey adoption.

Jun 13, 2026