Content reviewed: 24 September 2026
How the password generator creates randomness
CalcNator uses the browser's Web Crypto API rather than Math.random(). Random values are generated locally, and the password is not sent to CalcNator for generation or storage.
Character selection
You can include lowercase letters, uppercase letters, numbers and symbols. The generator guarantees at least one character from each selected group, fills the remaining positions from the combined pool and then securely shuffles the result.
Avoiding simple modulo bias
The implementation uses rejection sampling when mapping 32-bit random values to a character index. Values outside an evenly divisible range are discarded before the remainder operation, reducing the small selection bias that a direct modulo operation can introduce.
Password length matters
For randomly generated passwords, adding length generally increases the size of the possible password space. The strength indicator is only a rough entropy-style estimate based on length and the selected character pool; it is not a guarantee that a password cannot be compromised.
Safer password habits
- Use a different password for every account.
- Store long random passwords in a reputable password manager rather than trying to memorise all of them.
- Enable multi-factor authentication where available.
- Never reuse a password exposed in a breach.