Password generator with entropy estimate

How it works

crypto.getRandomValues fills a buffer with 32-bit unsigned integers. To pick one of n characters, a value x is accepted only if it is below the largest multiple of n that fits in 2^32. Otherwise it is thrown away and the next value is drawn. Accepted values are reduced with x % n. Without the rejection step, x % n favours the first 2^32 mod n characters slightly; with it, every character has exactly the same probability.

What the entropy means

The figure is length × log2(pool size). It is the attacker's work if they know your exact settings, which is the honest assumption. Twenty characters from the 62 letters and digits give about 119 bits. The figure only holds for passwords taken as they are: editing one by hand to make it memorable lowers it by an amount nobody can compute.

There is no "must contain a digit" rule. Forcing one character from each class removes possibilities and makes the entropy calculation wrong. For a length of 16 or more, a pool without one class is very unlikely anyway.

Pitfalls

Some systems truncate passwords silently; bcrypt uses only the first 72 bytes of its input. Some reject symbols such as < or &. If a site refuses a password, shorten it or untick symbols rather than editing characters by hand.