How Firefox Generates Strong Random Passwords

This article provides a complete overview of how the built-in password manager (about:logins) inside the Mozilla Firefox web browser generates strong, random passwords. It covers the cryptographic functions used to create true randomness, the specific character rules applied to ensure website compatibility, and the process of securing those newly generated credentials into the browser's database.

Detection of Password Fields

The password generation process begins when Firefox detects an account registration or password change form on a webpage. The browser scans the page's HTML for <input type="password"> elements. When a user clicks into a qualifying password field, Firefox triggers its internal PasswordGenerator module and prompts the user with a securely generated password option right below the input box.

Cryptographic Randomness (CSPRNG)

Humans are naturally predictable and poor at creating randomness, often relying on familiar words and sequential numbers. To solve this, Firefox does not use basic math functions to pick characters. Instead, it uses a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG).

Specifically, Firefox relies on the Web Crypto API, utilizing the crypto.getRandomValues() method. This function pulls high-entropy data (random noise) directly from the underlying operating system. Because the random numbers are generated using hardware and system-level entropy, it is computationally infeasible for an attacker to predict or reverse-engineer the sequence of characters Firefox will produce next.

Character Sets and Ambiguity Removal

To ensure the generated password is both secure and practical, Firefox follows strict parameters regarding length and character selection:

  • Length: Firefox generates passwords that are exactly 15 characters long by default.
  • Required Character Types: The algorithm pulls from three distinct character sets: lowercase letters, uppercase letters, and numbers (digits).
  • Maximum Compatibility: Firefox deliberately excludes special symbols (like @, #, or !) in its default generation. Many websites have outdated backend rules that reject certain symbols, so sticking to alphanumeric characters ensures the password works almost everywhere while maintaining high security through length and randomness.
  • Removal of Ambiguous Characters: To make passwords easier for users to read and type on other devices (such as a smart TV or mobile phone), Firefox strips out visually similar characters from its generation pool. Characters like I (uppercase i), l (lowercase L), 1 (one), O (uppercase o), and 0 (zero) are never used.

The Generation and Shuffling Process

If Firefox simply picked 15 random characters from a combined pool of letters and numbers, there is a small statistical chance it might generate a password with no numbers, which many websites would reject. To prevent this, Firefox builds the password in steps:

  1. Fulfilling Requirements: The browser first uses its cryptographic number generator to pick a minimum number of characters from each individual set (at least one lowercase letter, one uppercase letter, and one digit).
  2. Filling the Remainder: It then selects the remaining characters randomly from all allowed character sets combined until it reaches the 15-character limit.
  3. Shuffling: Finally, Firefox takes this 15-character string and scrambles the order of the characters using the Fisher-Yates shuffle algorithm, which is also powered by the CSPRNG. This ensures the required characters do not always appear at the very beginning of the password.

Saving to about:logins

Once the user clicks the suggested password, Firefox automatically fills it into the website's form field. At this exact moment, Firefox temporarily caches the password in memory. When the user submits the registration form, Firefox commits the new password and the associated website URL directly to about:logins. The password is then encrypted using the browser's key4.db cryptographic database and stored locally in the logins.json file, ready to be auto-filled the next time the user visits the site.