Password generation: alphabet size and unbiased randomness

State the uniform model

For independent uniform choices from N characters, length L has N to the L possible strings and L times log2(N) bits of entropy.

This estimate does not apply to human-selected phrases with predictable substitutions. The sample is a formula, not a strength rating for an existing password.

Uniform alphabet N=64, length L=16:
16 × log2(64) = 96 bits

Use a cryptographic random source

Browser password generation should use a cryptographic generator such as crypto.getRandomValues, not Math.random.

Nav Tools uses cryptographic randomness and rejection sampling to avoid modulo bias when selecting characters from its alphabet.

Character classes are a separate policy

An alphabet containing digits does not guarantee that every generated string contains a digit. Nav Tools does not promise one character from each class.

If a destination requires mandatory classes, use a reviewed policy-aware generator and account for how that policy changes the distribution.

Handle the result as a credential

A random password still needs protected storage and a secure delivery process. Its entropy does not protect it after exposure.

Use synthetic lengths for demos, save real credentials in an appropriate password manager, and regenerate a value if it was shared in a public channel.