/
Direct answer
UseCOS generates high-entropy random passwords and multi-word passphrases using your device's native Web Cryptography API (crypto.getRandomValues). Entropy is calculated in bits using Shannon information theory. Generated secrets are created locally in your browser memory and are never transmitted over the internet or saved to disk.
Generate unbreakable cryptographic passwords, memorable passphrases, and PINs. 100% offline-ready inside your device memory with zero server transmission.
Password strength is measured in bits of entropy (\(E = L \times \log_2(N)\)), where \(L\) is password length and \(N\) is the pool size of possible characters. A password with 80+ bits of entropy would take modern GPU superclusters millions of years to brute force.
| Entropy Range | Rating | Estimated Brute Force Time (100 Billion Guesses/sec) |
|---|---|---|
| < 40 bits | Very Weak | Few milliseconds to minutes |
| 40 – 64 bits | Moderate | Few hours to several days |
| 65 – 80 bits | Strong | Centuries to millennia |
| 80+ bits | Cryptographically Secure | Trillions of years (Uncrackable) |
Modern NIST (National Institute of Standards and Technology) guidelines favor multi-word passphrases (e.g., correct-horse-battery-staple) over short, cryptic strings with symbols. A 5-word Diceware passphrase drawn from an EFF wordlist provides ~65 bits of entropy while remaining easy to type on mobile keyboards.
Selecting the appropriate credential architecture based on human memorability and adversary threat models:
| Credential Type | Recommended Entropy | Primary Use Case | Adversary Resistance & NIST Status |
|---|---|---|---|
| Random Alphanumeric (16+ Chars) | 95 – 130 bits | Password Manager Autofill (Email, Banking, SaaS) | Immune to dictionary and mask attacks; requires password manager storage. |
| Diceware Passphrase (5+ Words) | 65 – 85 bits | Master Vault Passwords & Full Disk Encryption (BitLocker) | NIST Recommended; highly memorable and typing-friendly on mobile keyboards. |
| Numeric PIN (6–8 Digits) | 20 – 27 bits | ATM Cards, SIM Cards, Hardware Token Locks | Only secure when backed by hardware rate-limiting (e.g. 5 failed attempts auto-lock). |
| FIDO2 / WebAuthn Passkeys | Public-Key Cryptography | Primary Login Replacement (Google, Apple, Microsoft) | Highest security tier; fully immune to phishing, credential theft, and MITM attacks. |
Never reuse passwords across different online services. Always enable Hardware Security Keys (FIDO2 / WebAuthn) or Authenticator App Two-Factor Authentication (TOTP) on banking, email, and primary login accounts.
Generates numbers using OS-level cryptographic entropy collectors (hardware timing, CPU jitter, mouse motion) rather than insecure Math.random().
Authored by UseCOS Research & Engineering.