How CSPRNG Works
Standard JavaScript functions like Math.random() rely on pseudorandom number algorithms (like Xoroshiro128+) designed for fast math computations, not security. Because their state space is small and predictable, attackers who observe a sequence of random numbers can deduce the generator's internal seed.
In contrast, this tool exclusively uses window.crypto.getRandomValues(). On modern operating systems (Android, iOS, Linux, Windows), this invokes the kernel-level cryptographic entropy collector (such as /dev/urandom or CryptGenRandom) which pools physical hardware noise (CPU clock jitters, thermal sensors, and packet arrival times).
The Mathematics of Entropy
Password entropy is expressed in bits and represents the total search space an attacker must traverse during an offline brute-force attack:
Where L is the password length and N is the size of the character pool. A 20-character password drawn from a 94-character pool yields over 131 bits of entropy, requiring trillions of compute-years to crack even with state-of-the-art supercomputers.
Entropy Benchmarks & Brute-Force Resistance
Estimated time to crack using modern GPU clusters (e.g., 8x NVIDIA RTX 4090 executing 100 billion NTLM/SHA-256 hashes per second):
| Entropy Level | Bit Strength | Example Profile | Crack Time (Offline GPU) | Security Recommendation |
|---|---|---|---|---|
| Critical / Weak | < 35 bits | 8 chars (letters only) | Instant (< 2 minutes) | Unsafe. Immediately vulnerable to dictionary attack. |
| Moderate | 36 – 60 bits | 10 chars (alphanumeric) | Several hours to days | Acceptable for non-sensitive social media accounts. |
| Strong | 61 – 80 bits | 14 chars (full mixed pool) | Decades to centuries | Recommended by NIST for financial and corporate logins. |
| Military Grade | > 90 bits | 20+ chars (full pool) | Trillions of years | Recommended for root credentials, SSH keys, and password vaults. |
Android Developer Guide: Secure Credential Storage
If you are building an Android application that handles user passwords, API authorization tokens, or encryption keys, avoid saving secrets in standard XML SharedPreferences or SQLite databases.
Keys generated via MasterKey are stored in the hardware-backed Android Keystore system, preventing memory extraction even if the host Android device is rooted.