Methodology and test results

Everything a ProtemKey tool tells you is computed by two small JavaScript files, keys.js (generators and entropy) and strength.js (the checker). Every weekly rebuild runs those exact files in Node against the tests below and refuses to publish if one fails. Last run: 2026-10-31, Node v20.19.2.

1. Where the randomness comes from

All randomness comes from crypto.getRandomValues, the Web Crypto API's cryptographically secure generator, which browsers seed from the operating system. Math.random is never used. Values are drawn as 32-bit unsigned integers, 16,384 at a time.

To pick one of n things (a word, a character, a digit), the generator needs a whole number from 0 to n−1 with every value equally likely. Taking a random 32-bit number modulo n is slightly biased unless n divides 2³², so the generator uses rejection sampling:

limit = 2^32 − (2^32 mod n)      // the largest multiple of n that fits
repeat: x = next random 32-bit value
until x < limit
return x mod n

Every value below limit maps to each result exactly limit / n times, so the result is exactly uniform. The cost is an occasional redraw. In the worst case (n just over 2³¹) about half of all draws are rejected: in this run, 1,000,000 calls with n = 2³¹+1 used 2,000,644 draws, 2.0006 per call against 2.0000 expected. For 7,776 words the rejection chance is about 1 in 1,677,722. Modulo bias and rejection sampling explains this step by step.

Rules such as “at least one of each kind” or “avoid obvious PINs” are applied the same way: a candidate that breaks the rule is thrown away and a fresh one drawn, which keeps every allowed result equally likely.

2. Uniformity tests

Each test runs the generator functions visitors use, counts how often each outcome appears, and compares the counts with a perfectly even spread using Pearson's chi-square test. The p-value is the chance a perfectly fair generator would look at least this uneven; a test fails below p = 0.001. A fair generator fails such a test about once in a thousand runs by chance, so a failure triggers one full re-run before the build is stopped. This run needed 1 attempt.

The last row is a control. A byte has 256 values, and 256 = 2 × 94 + 68, so the naive method makes the first 68 characters 1.5 times as likely as the other 26. The same test catches that instantly, which shows it has the power to find real bias, not just that it passes. The full output of this run is at /validation.json.

In a browser. On 2026-10-26 the same two main tests ran inside headless Chrome/124.0.6367.78, loading this site's keys.js and calling the browser's own crypto.getRandomValues: passphrase words over 7,776,000 samples, χ² = 7891.2 on 7775 df, p = 0.175; password characters over 10,000,000 samples, χ² = 72.0 on 93 df, p = 0.947. Both pass.

3. Entropy formulas, checked by hand

The strength shown by each generator is computed from its settings, never estimated from its output: it is log₂ of the number of equally likely results. The cases below were worked out by hand as exact integer expressions (in the “count” column), evaluated by an independent Python script that shares no code with keys.js, and compared with what keys.js reports. They must agree to within 10⁻⁹ bits.

The formulas, for reference: k words from a list of W: k·log₂W; one capitalized word of k: +log₂k; random capitals: +k; a digit or symbol from a set of s on one of k words: +log₂s + log₂k; L characters from N: L·log₂N; with every one of the chosen kinds required, inclusion-exclusion over the kinds; PINs: log₂(10^L − excluded).

4. Bands and attack rates

The meter colors a number of bits by these bands. They are judgment calls, tied to the fast offline attack rate: below 30 bits falls in under a few seconds there; 75 bits takes thousands of years on average.

5. The strength checker and its labelled test set

The checker estimates guessing cost for a password a person typed: it splits the password into the cheapest pieces it can explain (common-list entries, dictionary words, keyboard walks, repeats, sequences, dates) and charges per character for the rest. The full rule table is on the checker page. Its common list is SecLists' “10k most common” (10,001 entries) and its dictionary is the EFF large wordlist (7,776 words).

It was tested on 90 passwords, each labelled with the band a realistic attacker would put it in. The labels were written before the checker was run on them and were not changed afterwards. Result: 71 in the expected band, 87 within one band, 5 rated stronger than labelled and 14 weaker. Rating a password two or more bands too strong is the dangerous mistake, and the build fails on it unless the case is listed as a known limit.

Where it disagrees with the labels

Known limits

• Tr0ub4dor&3: labelled weak, rated fair (47.9 bits). the checker's dictionary is only the 7,776 EFF words, so 'troubador' is charged letter by letter.
• Nov-14-1988: labelled weak, rated weak (33.9 bits). month names are not in the date rules, so 'Nov' is charged as three letters.
• 2580: labelled very-weak, rated very-weak (12.7 bits). keypad walks are not modelled; only the QWERTY keyboard is.
• correct horse battery staple: labelled very-weak, rated fair (54.6 bits). the checker has no list of famous passphrases; it scores the four words as if chosen at random.
• My first car was a blue 1998 Civic!: labelled fair, rated very-strong (97.9 bits). the checker charges most words of a sentence as random dictionary picks; real attackers model grammar and personal facts.
• rT6!vP2@kL9#: labelled very-strong, rated fair (53.3 bits). per-class charging (4.7 bits a letter, 3.3 a digit) under-rates random strings that are mostly digits and letters; the checker cannot know it was generated.
• PurpleMonkeyDishwasher: labelled fair, rated weak (39.3 bits). the checker has no list of phrases from popular culture.

Against secrets with known entropy

The checker was also run on 200 fresh outputs of each generator setting below, whose true entropy is known exactly. It may under-rate them, since it can't know a string was generated, but it must never rate one more than 15 bits stronger than it really is.

Random passphrases come out a few bits high, because the checker charges for the separator and capitals that the generator's figure treats as known settings. Random character strings come out low, because the checker charges each character by its own kind (4.7 bits for a letter) rather than the full set it was drawn from. Both are why the generators show their exact figure and the checker is for passwords people choose.

6. Sources and licenses

• EFF Large Wordlist (Joseph Bonneau, Electronic Frontier Foundation, 2016), eff_large_wordlist.txt. EFF publishes its original material under Creative Commons Attribution (its copyright page names CC BY 4.0). Used unchanged; pinned by SHA-256.
• SecLists Passwords/Common-Credentials/10k-most-common.txt (Daniel Miessler and contributors), github.com/danielmiessler/SecLists, MIT license. Pinned to commit 913b327 by SHA-256. Used only inside the checker and for the computed statistics in the guides; a few offensive entries are left out wherever entries are displayed.
• NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (August 2025), pages.nist.gov/800-63-4/sp800-63b.html. A work of the US government, quoted and paraphrased.
• Other sources (IETF RFCs, W3C recommendations, OWASP cheat sheets, papers) are cited on the guide that uses them.
• Everything else, including all text, code and illustrations, is original to ProtemKey.

7. What the build checks

• The two downloaded lists match their pinned SHA-256 hashes; the wordlist has 7,776 distinct words, is prefix-free, and its hyphenated words don't split into list words.
• All uniformity tests pass (one re-run allowed), and the biased control is detected.
• Every entropy figure in section 3 matches the hand calculation.
• The checker never rates a labelled password two bands too strong (outside known limits) and never over-rates a generated secret by more than 15 bits.
• Every internal link resolves, and every guide has its required fields.