Password generator
Random passwords and passphrases, drawn from your device's own random source. The entropy figure below is the real one, not a score invented to make you feel good about six characters.
Generate
The words come from the EFF long word list, 7776 of them, which is the standard Diceware list. Each word is worth 12.9 bits, so six words beat almost any password a person invents.
Result
Entropy
What this is actually doing
Every character comes from crypto.getRandomValues, the browser's
cryptographic random source. The obvious alternative, Math.random, is a
fast pseudo-random generator seeded from a value an attacker can often work out, and
it should never be used for anything a person will treat as a secret.
The second thing worth knowing is why the generator discards some random numbers rather than using all of them. If you take a random number and divide it by the size of your alphabet, the first few characters come up slightly more often than the rest. That is modulo bias, and it shrinks the space an attacker has to search. This one throws away the values that would cause it, which is why the entropy figure is exact rather than approximate.
The figure itself is length × log₂(alphabet). It assumes the password is
used on a system that stores it properly. If a site stores passwords with a fast hash
and no salt, no amount of length saves a short password, because the attacker is not
guessing your password, they are guessing everyone's at once.
Build it yourself
The same generator in a dozen lines of shell, using /dev/urandom,
tr and openssl, plus the entropy arithmetic and why the
shell's own $RANDOM is not good enough.
Other utilities
Base64, Base64URL, hex, URL, ROT13, HTML entities and binary.
MD5, SHA-1 and the SHA-2 family, over text or a file, with a compare mode.
Read a token, check its claims, and actually verify the signature.
Octal and symbolic file permissions, including the special bits.
CIDR to network, broadcast, host range and host count, for v4 and v6.