Password generator

Entropy is reported as bits = length × log2(charsetSize) — the theoretical maximum for a uniformly-random password drawn from the chosen charset. It does not account for human-memorable patterns, breach-list overlap, or attacker knowledge of the charset rules.

Qualitative labels follow common rules of thumb:

• Weak: < 40 bits
• Fair: 40 – 59 bits
• Strong: 60 – 79 bits
• Very strong: ≥ 80 bits

Pronounceable mode alternates consonants and vowels, so each character carries less entropy than the full charset would — the meter reflects this.

Passphrase mode picks uniformly from the embedded EFF Short Wordlist #1 (1,296 words). Entropy is bits = wordCount × log2(1296) ≈ wordCount × 10.34. This assumes words are independent and unknown to an attacker; it does not account for grammar, common phrases, or breach-list overlap. EFF suggests at least six words for comparable strength to a random password — fewer words mean fewer bits.

Random characters use crypto.getRandomValues(Uint32Array) with rejection sampling, so the distribution is unbiased even when the charset size does not divide 2³². Math.random is never used for password material.

Bulk mode generates independent passwords with the same options. The strength meter still reports entropy for one password — having many passwords does not multiply entropy.

No "secure" claims — strength depends entirely on how and where you use the password. Treat this as a generator, not a vault.