Password Security Guidelines for Developers
Password security guidelines are the practices for generating, sizing and storing secrets so that guessing them is impractical: create values with a cryptographic random number generator, pick a length that matches the threat model, use one secret per account, and keep them in a password manager instead of code or plain-text notes. The unit of measurement is entropy — the number of bits of unpredictability in the generated value.
Generate and store secrets in four steps
- Generate with a cryptographically secure random source. Browsers expose
crypto.getRandomValues();Math.random()is predictable and must never produce a secret. DevPlain's generator is built on Web Crypto and produces up to 64 characters from the character set you pick. - Choose a length from the threat model. A device PIN that locks after a few wrong attempts tolerates low entropy; an email or cloud account reachable from anywhere does not.
- Use a unique generated secret for every account, so a leak at one service cannot be replayed against another. Uniqueness is what makes password reuse — still one of the most common failure modes — impossible.
- Store secrets in a password manager, and for device PINs enable rate limiting and a lockout after repeated failures. A generated secret in a log file, a screenshot or a client-side bundle undoes everything that came before.
How much entropy is enough
Entropy is the base-2 logarithm of the number of possible values. A few reference points:
| Secret | Combinations | Approximate entropy |
|---|---|---|
| 4-digit PIN | 10,000 | 13.3 bits |
| 8 lowercase letters | 268 | 37.6 bits |
| 12 mixed characters | 9512 | 78.8 bits |
| 16 mixed characters | 9516 | 105.1 bits |
The table shows why length dominates: moving from 12 to 16 mixed characters roughly quadruples the exponent, while switching from letters-only to mixed characters multiplies it once. A four-digit PIN is fine for a phone that wipes after ten attempts and unsuitable for anything reachable online.
A real example: entropy by the numbers
PIN, 4 numeric digits: log2(10^4) = 13.3 bits
Password, 16 mixed chars: log2(95^16) = 105.1 bitsGenerating in the browser keeps the value local: Web Crypto runs on the device, and the secret is never transmitted. One caution — encoding a password with Base64 is not encryption; it is a reversible, keyless transform, so it offers zero protection against anyone who intercepts the value.
Generation in practice
A browser-based generator is enough for everyday use as long as it is honest about its ingredients. DevPlain's generator draws bytes from Web Crypto, offers character sets from every class down to digits-only, and accepts lengths from 4 to 64 characters. Prefer the full mixed set for account passwords, and use digits-only mode only for the short PIN case described above. If you prefer passphrases, generate several unrelated words the same way — randomly chosen words from a large list beat clever human patterns, because people are poor sources of randomness. And remember the split of responsibilities: generation and storage are client-side practices, while a service that checks your password must hash it with a dedicated password-hashing function on its servers — no reputable site ever needs to know your password in plain text.
Frequently asked questions
- How much entropy does a 4-digit PIN have?
- About 13.3 bits, because 10,000 combinations are possible and log2(10000) ≈ 13.29. That is enough for a device that rate-limits attempts and wipes after repeated failures, and far too little for an online account where an attacker can try millions of guesses.
- How long should a generated password be?
- At least 12 to 16 characters drawn from mixed character classes, or a longer passphrase made of unrelated words. Length dominates: each extra character from a 95-symbol alphabet adds roughly 6.6 bits of entropy, while adding one more symbol class to a short password adds far less.
- Is it safe to store passwords in a browser?
- A browser-synced vault or a dedicated password manager protected by a strong, unique master password is a better default than memorizing dozens of secrets or reusing one. Whatever you choose, keep secrets out of source code, notes files, spreadsheets and logs.
Related tools
- Password Generator — Web Crypto secrets up to 64 characters, no network involved.
- Random 4-Digit PIN Generator — numeric PINs for rate-limited device unlock.
- Base64 Encoder — reversible encoding for transport, not for protecting secrets.
Last updated: