Pseudo-Random (PRNG) vs Cryptographically Secure PRNG (CSPRNG)
Many developers inadvertently use Math.random() to generate session tokens, verification codes, or user passwords. In cybersecurity, this creates a severe vulnerability.
1. How Math.random() Works: JavaScript engines (like Google Chrome V8) use algorithms such as xorshift128+. These are deterministic mathematical sequences. If an adversary captures a sequence of generated values, they can compute the internal seed state and reliably predict every subsequent "random" number.
2. Web Crypto API (CSPRNG): The browser's crypto.getRandomValues() interface taps into the operating system's hardware entropy pool (thermal noise, interrupt timing, and hardware jitter), generating mathematically unpredictable random bytes.
Password Entropy & Brute-Force Feasibility
A password's resilience against brute-force attacks is quantified in bits of entropy:
$$\text{Entropy} = L \times \log_2(N)$$
Where $L$ is password length and $N$ is the character pool size.
- An 8-character numeric PIN possesses only ~26.6 bits of entropy, which modern GPU clusters can crack in under 1 second.
- A 16-character alphanumeric password with special symbols provides ~95.2 bits of entropy, requiring billions of years of distributed computation to brute-force.
FuaHub Password Generator runs exclusively on the browser's crypto.getRandomValues() API within local device RAM, providing bank-grade security.