HOW IT WORKS
Security by design.
Cryptographic randomness
All choices use crypto.getRandomValues(). KeyMint does not use Math.random() for passwords, words or PINs. To choose uniformly among a given number of possibilities, the generator discards random 32-bit values outside an even multiple of that number (rejection sampling). Fisher–Yates shuffling, also driven by cryptographic randomness, rearranges password characters.
Character constraints
When you select uppercase letters, lowercase letters, numbers or symbols, KeyMint includes at least one character from each selected category. Optional filters remove easily confused characters and prevent repeats, subject to the available character count. Options that cannot be satisfied produce a visible error instead of silently weakening the password.
Passphrases
The included English word list contains exactly 4,096 unique words. Each word is chosen independently, using uniform cryptographic selection. That provides 12 bits per word before optional digits; for example, six words give 72 bits from word selection. Capitalization and separators are user-selected formatting and are not counted as extra randomness. You may see unusual words because the list is derived from a general-language spelling frequency corpus; it is not the official EFF Diceware list.
Strength estimates
The displayed bit count is the idealized search-space estimate from the selected pool and requested length, not a tested cracking-time prediction. Passwords with required character categories or non-repeating characters may have a different actual output distribution than a fully uniform draw from the displayed pool. The passphrase and PIN figures are directly based on the random selection process. Do not treat the strength indicator as a guarantee against phishing, malware, breaches, or compromised devices.
Recommended habits
- Use a unique password for each account; a trusted password manager makes this practical.
- Prefer longer randomly generated passwords where the service permits them.
- For memorable passphrases, use at least six independent words whenever possible.
- Turn on multi-factor authentication, ideally a passkey or security key, when available.
- Do not copy secrets on public/shared computers unless you trust the device and clipboard.
- Use an HTTPS website when accessing this tool online. HTTPS guards against code tampering in transit.
Auditable, static implementation
The deployable package includes the HTML, CSS, JavaScript, and dictionary. No runtime API key or backend service is required. Hosting security headers on the main generator page block third-party scripts and network requests. Educational pages may show Google advertising, but ads are not loaded on the generator page. The code is provided as readable source files rather than opaque bundles.