2026-10-19 · 8 min read
- passwords
- security
- generators
The password tool draws in the browser with crypto.getRandomValues. Each character is chosen from one string: the classes you checked, concatenated in a fixed order. Lowercase, then uppercase, then digits, then symbols. A class that is checked is available. It is not guaranteed to occur.
That distinction is the whole policy bug. A form that says the password must include a symbol is stricter than a checkbox that says symbols may be included. Reject and draw again when the result misses a class you require.
Write the alphabet down
Lowercase is 26 letters, a through z. Uppercase is A through Z. Digits are 0 through 9. The symbol class is exactly these 23 characters, in this order: !@#$%^&*()-_=+[]{};:,.? All four classes make 85 characters. Space, quotes, apostrophes, slashes, backticks, tildes, and pipes are absent. A system that forbids one of the included symbols needs a different alphabet than this page.
No boxes checked is an empty string, and the page shows Error: Alphabet is empty. Copy is disabled for that error. Turn at least one class back on. The error is the tool refusing to divide by zero, not a password made of nothing on purpose.
- Record the four checkboxes next to any password you keep.
- Count 85 only when all four are on.
- Add a required-class check outside the tool.
- Do not paste a generated password into a ticket or a chat.
Expect a small modulo bias
Each draw takes one uint32 and reduces it with the remainder of the alphabet length. Over every possible uint32, the first R characters of the alphabet occur once more than the others. R is 2^32 modulo the length. The index order is the concatenation order above.
All four classes give length 85 and R of 1, so a is the extra character and the gap is one count in about 50 million draws. Digits alone give length 10 and R of 6, so 0 through 5 are the extra characters and 6 through 9 are the short ones. The bias is real, it is larger on a short alphabet, and it is not removed by the Regenerate button. Regenerate only changes a seed so the memoized draw runs again.
Clamp length before you count characters
The field accepts 4 through 128. A cleared field becomes 0 and the clamp raises it to 4, so the next draw is four characters, not a blank password. A fractional entry such as 20.9 stays 20.9 through the clamp and is then truncated by the array length, so the string has 20 characters. Count the output. Do not count the number you typed if it was not an integer.
The hash tool does not finish this job. It prints a SHA-256 or SHA-512 hex digest of pasted text, and the page says that hash is not password storage. Hashing a generated password with SHA-256 and saving the hex is not a password database. The UUID tool is for identifiers, not for secrets either.
Review the policy beside the draw
Write the required classes, the allowed symbols, and the minimum length in the policy. Diff that list against the checkboxes and the 23-symbol set. If they differ, the tool is the wrong last step, or the policy is. Generate only after that diff is empty, then check the result for a character from each required class.
Use the password tool for the draw, diff for the policy text, the hash tool only when you meant to hash some other text, and the UUID tool when the value is an identifier. Leave the password on the machine that will store it.