The library is used for generating cryptographically secure secrets with a high level of randomness is Atoll.

Here is some important information about secret generation.

Atoll guarantees that the password will contain at least one of the characters of each level selected (except Space¹), only if the length of the password is higher than the number of levels.

¹ If the level Space is used or the user includes a space it isn't 100% sure that the space will be part of the secret, as it could be at the end or the start of the password and it would be deleted and replaced by the sanitizer.

1. Lowecases (a, b, c...)
2. Uppercases (A, B, C...)
3. Digits (1, 2, 3...)
4. Space
5. Special (!, $, %...)

Atoll offers 3 ways of generating a passphrase:

• Without a list (NoList): generate random numbers that determine the word length (between 3 and 12 letters) and if the letter is either a vowel or a constant (4/10 times a vowel is selected). Note that not using a list makes the potential attacker job harder.

• With a Word list (WordList): random words are taken from a 18,235 long word list.

• With a Syllable list (SyllableList): random syllables are taken from a 10,129 long syllable list.

Randomness is a measure of the observer's ignorance, not an inherent quality of a process.

Atoll uses the "crypto/rand" package to generate cryptographically secure random numbers.

Entropy is a measure of the uncertainty of a system, it tells how hard it will be to guess the passphrase itself even if an attacker knows the method you used to select your passphrase. A passphrase is more secure if it is selected using a method that has more entropy.

Entropy is measured in bits. The outcome of a single coin toss -- "heads or tails" -- has one bit of entropy.

Entropy = log2(poolLength ^ secretLength)

Keyspace is the set of all possible permutations of a key. On average, half the key space must be searched to find the solution.

Keyspace = poolLength ^ secretLength

When calculating the seconds to crack the secret what is considered is a brute force attack. Dictionary and social engineering attacks (like shoulder surfing. pretexting, etc) are left out of consideration.

The time taken in seconds by a brute force attack to crack a secret is calculated by doing keyspace / guessesPerSecond where the guesses per second is 1 trillon, this is the number Edward Snowden said we should be prepared for and might be changed in the future.

In 2019 a record was set for a computer trying to generate every conceivable password. It achieved a rate faster than 100 billion guesses per second.