Why use Locksmith?
Generated passwords and passphrases never leave your device — every value is created locally using cryptographic randomness and discarded when you close the tab.
Cryptographic randomness, not Math.random()
Passwords are generated using crypto.getRandomValues — the browser's cryptographically secure random number generator. JavaScript's built-in Math.random() is a pseudo-random algorithm whose output can theoretically be predicted. The distinction matters when you're generating security credentials, not rolling dice in a game.
No generated password lives on any server
Some password tools log generated values "for convenience" or to power autocomplete suggestions. That means your credential is sitting in someone else's database. Locksmith generates, displays, and immediately discards — the value exists only in the input field until you copy it.
A generator is not a manager
A password generator and a password manager are different tools with different risk profiles. Locksmith handles generation only. For storing credentials, use a reputable dedicated vault. Combining both functions in a single online service introduces attack surface that doesn't need to exist.
Entropy shown in bits, not marketing grades
The strength indicator shows actual entropy — the number of bits of randomness — rather than a color scale designed to make a weak password feel acceptable. A 16-character random password has roughly 105 bits of entropy. A common word with a number substitution has far less, regardless of what a grade of "Strong" might suggest.
Cryptographic randomness: why Math.random isn't good enough
Every credential Locksmith produces is drawn from crypto.getRandomValues() or crypto.randomUUID() — the Web Crypto API's cryptographically secure pseudo-random number generator (CSPRNG), seeded by the operating system's entropy source. This is fundamentally different from Math.random(), which uses a deterministic algorithm whose output can be reproduced if the internal state is known. CSPRNG output passes statistical randomness tests and is computationally infeasible to predict from prior output — the baseline requirement for anything used as a key, token, identifier, or secret.
UUID versions: v1 through v7 and when to use each
UUID v1 encodes the current timestamp plus the host MAC address — globally unique but potentially revealing about its origin. UUID v4 is 122 bits of pure randomness with no structure, and is the current default for distributed primary keys where you need uniqueness without coordination. UUID v5 is deterministic: it derives a UUID from a namespace and a name using SHA-1, so the same input always produces the same output — useful for stable, reproducible IDs. UUID v6 reorders v1's timestamp bytes for better B-tree locality. UUID v7, the newest standard, places a 48-bit millisecond timestamp in the high bits followed by random bytes, making identifiers monotonically increasing per millisecond and index-friendly in any database that performs faster inserts when keys arrive in order. Locksmith also decodes any UUID back to its version, variant, and embedded timestamp where applicable.
Password entropy: length and character sets determine strength
Password strength is measured in bits of entropy: log₂(charset_size ^ length). A 12-character password from lowercase letters only yields about 56 bits — crackable in hours with a modern GPU. Adding uppercase, digits, and symbols expands the charset from 26 to 94 characters, pushing the same 12-character password to roughly 79 bits. At 16 characters across the full charset, entropy exceeds 104 bits — where brute-force attacks become computationally infeasible for the foreseeable future. Locksmith displays live entropy as you adjust settings, shows a time-to-crack estimate, and guarantees at least one character from each enabled set so generated passwords satisfy most service requirements without sacrificing randomness.
Passphrases: high entropy that humans can actually remember
A four-word passphrase drawn from a 2048-word list has log₂(2048⁴) = 44 bits of entropy — comparable to a random 8-character symbol-heavy password. Six words reaches 66 bits; seven words reaches 77 bits. The advantage is memorability: a string of unrelated words is far easier to recall than an equivalent string of random characters. Diceware-style passphrases are the recommendation in NIST SP 800-63B, which explicitly discourages mandatory complexity rules in favor of length. Locksmith generates passphrases from a curated word list, shows entropy for the selected word count, and supports capitalization modes for services that require at least one uppercase character.
Why secure randomness is harder than it sounds
Computers are deterministic — left alone, they’d produce the same sequence every time. A standard random number generator uses a math formula that only looks random. If an attacker figures out its internal state (and with some older generators they can), they can predict your “random” password or token. A cryptographically secure random generator gets its randomness from physical noise — thermal fluctuations in hardware, timing jitter between events — things no formula can predict. Every secret Locksmith generates comes from your operating system’s secure entropy source, not a math formula.
UUID versions: the differences that actually matter in practice
All UUIDs are unique, but they’re not built the same. Version 4 is the safe default: pure random, no information encoded in it. Version 7 adds a timestamp to the front so IDs generated over time sort in the order they were created. This is a meaningful advantage in databases — sorted inserts are faster, and queries filtering by creation time can skip large chunks of data. Unless you have a specific reason for another version, v4 or v7 is almost always the right choice.
What makes a password actually strong
Password strength comes down to how many guesses an attacker needs to crack it. Every character you add multiplies the number of possibilities — adding one character to a 10-character password makes it roughly 95 times harder to crack. Going from 10 characters to 14 characters does more for security than adding symbols to a short password. The strength meter here shows you the real math: how many bits of entropy your password has, and roughly how long it would take a modern system to brute-force it.
Why four random words beat a complicated password
“correct horse battery staple” is more secure than “P@ssw0rd!” even though the second one checks every complexity box. Four common words strung together are harder to crack because the pool of possible word combinations is enormous — and the phrase is something you can actually remember. The US government’s own cybersecurity guidelines (NIST) dropped mandatory complexity rules in favor of simply requiring longer passwords. Six random words hits the same security level as a very long random string, with the advantage that you can remember it.