Technical Overview
with accompanying code

Isn't Math.random() not secure (entropy-wise)?

It isn't, and that's why this app doesn't use it for passwords. Word selection uses the browser's crypto.getRandomValues() API, so each word index is drawn from a cryptographically secure random source. No seed or server is involved.

For compatibility, seedrandom is still loaded and can be used elsewhere; the important part is that your passphrase is generated with the same API used for TLS and key generation.

---

What about the word list?

The application utilizes a 7,776-word listing. The wordlist was derived from The EFF's new long list. Great compilation.

You may have noticed on the first request this site, it takes a little bit to get up and running (but hopefully not). That's because your browser is downloading the full wordlist into an array within your browser to choose from. This makes absolutely certain there are no server-side calls after the wordlist is successfully downloaded.

  $('.btn-regenerate').prop('disabled', true);
  $.get('xkcd_wordlist.txt').then(function(data) {
    wordList = data.split(/\r?\n/).map(function(s) { return s.trim(); }).filter(Boolean);
    $('.btn-regenerate').prop('disabled', false);
    $('#password_box').removeClass('password-loading');
    updatePasswordField();
  });
                    

Future note, if there is enough of a call for it, I'd like to add functionality for custom wordlists. We'll see if this becomes popular enough to warrant it.

---

Command Line Access

This route comes with a BIG caveat: it should not be considered secure. Calls made to the command line via secure@xkcd-pw:~$ curl -L xkcd.pw/ is not generated locally. It is making a call to a server-side, command-line xkcd password generator.

Optionally, adding additional path parameters returns a different word count. Check out the example below.

  secure@xkcd-pw:~$ curl -L xkcd.pw/7
  
  dissoluteness wintergreen fawkes tolkien sole skater writ
  
  secure@xkcd-pw:~$ curl -L xkcd.pw/1
  
  vindicator
                    

---

Helping Out

Spread the word to people who might be interested. Telling someone to check xkcd.pw for xkcd passwords is dead simple and really helps.