Password Generator Formula and Entropy Calculation

Review character-pool filtering, unbiased Web Crypto index mapping, required-type counting, no-repeat permutations, entropy, and strength bands.

How do the Password Generator formulas work?

This formula page defines the variables used by the Password Generator, shows how those values are combined, and explains the order of operations behind the result. Use the worked steps to verify an estimate, compare scenarios, and understand which assumptions or rounding rules can affect the displayed answer.

Formula Overview

The engine builds a filtered character pool, generates uniformly distributed candidates from that pool, and accepts only candidates containing every enabled character type. The entropy value is the base-2 logarithm of the exact valid-password count under the selected settings.

Variable Definitions

L: requested password length
N: total filtered character-pool size
k: number of enabled character types
nᵢ: filtered size of enabled type i
S: a subset of enabled types treated as missing
V: number of valid passwords containing every enabled type
H: estimated entropy in bits
r: unsigned 32-bit Web Crypto source value

Character-Pool Construction

The base sets contain 26 lowercase letters, 26 uppercase letters, 10 digits, and 32 printable ASCII symbols. The calculator combines enabled sets and removes every selected ambiguous or bracket character. Duplicate characters are eliminated before generation.

N=\sum_{i=1}^{k}n_i

Unbiased Web Crypto Index Selection

A direct r modulo N mapping can favor some indexes when N does not divide 2³². The engine first calculates the largest complete multiple of N below or equal to 2³²:

T=\left\lfloor\frac{2^{32}}{N}\right\rfloor N

Values at or above T are rejected. An accepted value maps to an index with:

index=r\bmod N,\quad r<T

Counting Passwords with Every Required Type

When repeats are allowed, unrestricted generation has Nᴸ possible strings. The engine uses inclusion-exclusion to subtract strings missing one or more enabled types:

V=\sum_{S\subseteq\{1,\ldots,k\}}(-1)^{|S|}\left(N-\sum_{i\in S}n_i\right)^L

Candidate generation is uniform over the full pool. Rejecting candidates that miss a selected type conditions that uniform distribution on the valid set, so every accepted valid password retains equal probability.

No-Repeat Password Formula

When repeated characters are disabled, the count for a pool of size n uses ordered selections without replacement:

P(n,L)=\frac{n!}{(n-L)!}

The inclusion-exclusion formula substitutes P(n, L) for each power term. A no-repeat request is invalid when L exceeds the filtered pool size.

Password Entropy Calculation

H=\log_2(V)

This value measures the random generator's modeled choice space when an attacker knows the method and settings but not the generated result. It is not an estimate for a human-chosen password and does not account for password storage, reuse, phishing, malware, recovery workflows, or rate limiting.

Displayed Strength Bands

Modeled entropy	Displayed label
Below 60 bits	Needs more length
60 to below 80 bits	Good
80 to below 100 bits	Strong
100 bits or more	Very strong

The thresholds are interface categories, not guarantees of resistance time or account safety.

Worked Entropy Calculation

Suppose lowercase letters and digits are enabled with no exclusions, repeats are allowed, and the length is 12. The pool contains 36 characters. Requiring both types gives:

V=36^{12}-26^{12}-10^{12}

H=\log_2(V)\approx62.01\text{ bits}

The displayed label is Good because the modeled entropy is at least 60 bits but below 80 bits.

Assumptions and Boundaries

The runtime supplies a working Web Crypto getRandomValues method.
Password length is a whole number from 8 through 128.
At least one character type is enabled.
Every accepted password includes every enabled character type.
The attacker is assumed to know the settings and algorithm.
The password is assumed to remain secret, unique, and securely stored.
The estimate does not model third-party password hashing, rate limits, breach blocklists, or authentication factors.

Use the Password Generator