Choose randomness for the actual requirement
A decorative animation can use ordinary pseudo-random variation without promising security. A password generator needs a different standard and should use the browser’s cryptographic facilities. Be explicit about that distinction in implementation and interface copy. Calling something random does not explain its source, distribution or suitability for the operation the visitor intends to perform.
Fill an integer typed array
crypto.getRandomValues writes values into an integer typed array supplied by the caller. For a modest password operation, a small Uint8Array provides a convenient batch of random byte values. Keep allocations proportionate to the requested output. The API has a per-call byte limit, so generating a very large payload requires deliberate chunking rather than one enormous request.
See the bias in a small example
A byte has 256 possible values. If an alphabet has ten characters, mapping every byte with value modulo ten gives some characters more possible byte inputs than others. Reject bytes at or above 250, then map the remaining bytes modulo ten. Every retained character now has the same number of byte inputs, making the selection rule easier to reason about.
Generalize with rejection sampling
For an alphabet of length n that fits the byte range, calculate the largest multiple of n no greater than 256 and reject values beyond that boundary. Continue drawing until the required output length is reached. This addresses distribution bias in the mapping step; it does not by itself establish a complete password policy or guarantee every character category appears in a result.
Keep promises limited and useful
Explain the selected alphabet, length range and local processing behavior. Do not call Base64 encoding encryption or imply that a generated value can be recovered after closing the page. Clipboard history, screen sharing and browser extensions are separate considerations from randomness. For actual cryptographic key creation, use the appropriate key-generation API and a reviewed protocol rather than repurposing a password helper.
Verify constraints rather than predicting output
Check requested lengths, permitted characters and error handling when an API is unavailable. Exercise the rejection boundary with controlled test values in a small isolated mapping function. Do not expect a single short output to include every character type. Review the interface so that copying, regeneration and replacing an old result are clear without logging generated secrets into diagnostics.
Further reading
Put the idea to work.
Explore free browser tools for images, text and developer workflows.