密码生成器：熵值、CSPRNG 与账户安全

理论搜索空间（比特） = 密码长度 × log₂(字符集大小)

// 使用密码安全的随机数生成器生成密码
function generatePassword(length = 12, options = {
  uppercase: true,
  lowercase: true,
  numbers: true,
  symbols: true,
  excludeSimilar: false
}) {
  if (!Number.isInteger(length) || length <= 0) {
    throw new RangeError('长度必须是正整数');
  }
  const charset = {
    uppercase: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',
    lowercase: 'abcdefghijklmnopqrstuvwxyz',
    numbers: '0123456789',
    symbols: '!@#$%^&*()_+-=[]{}|;:,.<>?'
  };
  
  let allChars = '';
  if (options.uppercase) allChars += charset.uppercase;
  if (options.lowercase) allChars += charset.lowercase;
  if (options.numbers) allChars += charset.numbers;
  if (options.symbols) allChars += charset.symbols;
  
  if (options.excludeSimilar) {
    allChars = allChars.replace(/[l1Io0O]/g, '');
  }
  
  if (allChars.length === 0) {
    throw new Error('至少需要选择一种字符类型');
  }
  
  let password = '';
  const limit = 256 - (256 % allChars.length);
  while (password.length < length) {
    const array = new Uint8Array(1);
    window.crypto.getRandomValues(array);
    if (array[0] >= limit) continue; // 拒绝采样，避免取模偏差
    password += allChars[array[0] % allChars.length];
  }
  
  return password;
}

// 生成16位包含所有字符类型的密码
const password = generatePassword(16);
// 直接交给可信的密码管理器流程；生产环境不要记录秘密。

import secrets
import string

def generate_password(length=12, uppercase=True, lowercase=True, numbers=True, symbols=True, exclude_similar=False):
    charset = ''
    if uppercase:
        charset += string.ascii_uppercase
    if lowercase:
        charset += string.ascii_lowercase
    if numbers:
        charset += string.digits
    if symbols:
        charset += string.punctuation
    
    if exclude_similar:
        charset = charset.translate(str.maketrans('', '', 'l1Io0O'))
    
    if not charset:
        raise ValueError("至少需要选择一种字符类型")
    
    password = ''.join(secrets.choice(charset) for _ in range(length))
    return password

# 生成14位包含字母和数字的密码
password = generate_password(14, symbols=False)
# 通过可信流程存储；生产环境不要打印秘密。

import java.security.SecureRandom;
import java.util.HashSet;
import java.util.Set;

public class PasswordGenerator {
    private static final String UPPERCASE = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
    private static final String LOWERCASE = "abcdefghijklmnopqrstuvwxyz";
    private static final String NUMBERS = "0123456789";
    private static final String SYMBOLS = "!@#$%^&*()_+-=[]{}|;:,.<>?";
    private static final String SIMILAR_CHARS = "l1Io0O";
    
    private final SecureRandom secureRandom;
    
    public PasswordGenerator() {
        this.secureRandom = new SecureRandom();
    }
    
    public String generate(int length, boolean includeUppercase, boolean includeLowercase,
                          boolean includeNumbers, boolean includeSymbols, boolean excludeSimilar) {
        
        StringBuilder charset = new StringBuilder();
        if (includeUppercase) charset.append(UPPERCASE);
        if (includeLowercase) charset.append(LOWERCASE);
        if (includeNumbers) charset.append(NUMBERS);
        if (includeSymbols) charset.append(SYMBOLS);
        
        String charSetStr = charset.toString();
        
        if (excludeSimilar) {
            charSetStr = removeSimilarChars(charSetStr);
        }
        
        if (charSetStr.isEmpty()) {
            throw new IllegalArgumentException("至少需要选择一种字符类型");
        }
        
        StringBuilder password = new StringBuilder(length);
        for (int i = 0; i < length; i++) {
            int randomIndex = secureRandom.nextInt(charSetStr.length());
            password.append(charSetStr.charAt(randomIndex));
        }
        
        return password.toString();
    }
    
    private String removeSimilarChars(String input) {
        Set<Character> similarSet = new HashSet<>();
        for (char c : SIMILAR_CHARS.toCharArray()) {
            similarSet.add(c);
        }
        
        StringBuilder result = new StringBuilder();
        for (char c : input.toCharArray()) {
            if (!similarSet.contains(c)) {
                result.append(c);
            }
        }
        
        return result.toString();
    }
    
    public static void main(String[] args) {
        PasswordGenerator generator = new PasswordGenerator();
        String password = generator.generate(16, true, true, true, true, false);
        // 通过可信流程存储；生产环境不要打印秘密。
    }
}