Randomness you can watch.

1Where the randomness comes from

Passlore asks your browser for random numbers with crypto.getRandomValues, part of the Web Crypto API. The browser takes them from the operating system’s cryptographically secure generator — the same source used for encryption keys. It never uses Math.random, which is fast but predictable.

const buf = new Uint32Array(1);
crypto.getRandomValues(buf);   // 0 … 4,294,967,295, unpredictable

That’s step 1 in the card above. Every number you see there came from this call, just now.

2Every character equally likely

A random number has to become a character. The obvious way — divide by the number of characters and keep the remainder — quietly favours some characters whenever the range of numbers isn’t an exact multiple of the pool. Passlore uses rejection sampling: it throws away the few numbers that would cause the unevenness and draws again, so every character is exactly as likely as every other.

function randomIndex(n) {
  const limit = Math.floor(2 ** 32 / n) * n;   // largest multiple of n
  const buf = new Uint32Array(1);
  do { crypto.getRandomValues(buf); } while (buf[0] >= limit);
  return buf[0] % n;
}

3What makes a password strong

Strength is counted in bits of entropy: how many equally likely possibilities there are. For random characters it’s log₂(pool size) × length. Length multiplies, variety adds a little per character, and anything predictable — words you chose, patterns, a fixed prefix — adds nothing, so Passlore doesn’t count it.

The time assumes an attacker who knows how the password was made and tests 100 billion guesses a second. It’s an estimate, not a guarantee, and Passlore always labels it that way.

4What the breach check sends

The check is off until you press it. Then your device computes the password’s SHA-1 hash — 40 characters — and sends only the first 5 to Have I Been Pwned. The service replies with hundreds of hash endings that share those 5 characters, padded so the size of the reply gives nothing away. Passlore looks for the rest of your hash in that list, here, on your device.

Three outcomes, never blurred: found (don’t use it), not found (a good sign, not proof of safety), or couldn’t check (unknown — never shown as safe).

5What Passlore can’t promise

6Open source

Every line is public under the MIT licence. The generation code is a few small browser-only modules you can read in minutes — the same ones running the demos on this page. Source: github.com/soubhik-biswas/passlore. Found something wrong? Open an issue.