Generation is a choice of purpose and handling.

1. Password

Configurable length from 8 to 128, with lowercase, uppercase, digits and symbols selected independently. The engine samples uniformly from the complete set of strings that satisfy the enabled character-set constraints, using cryptographic randomness and rejection sampling. Its displayed estimate is the floor of the base-2 logarithm of that valid output space. Ambiguous glyphs can be excluded. The displayed entropy is a model based on the configured sets, not a guarantee about an account or its login policy.

• Best for: accounts and password-manager entries.
• Use a unique value per account and enable MFA where available.
• Generation requires a secure browser context; no Math.random fallback is used.

2. Random-word passphrase

Six to sixteen independent words are selected from the standard 2,048-word English BIP-39 vocabulary using secure random selection. This is a passphrase generator only: it does not perform BIP-39 checksum construction or wallet derivation.

• Best for: human-entered secrets where longer text is accepted.
• The estimated selection space is 11 bits per independently selected word.
• Do not use its output as a cryptocurrency seed phrase.

3. Numeric PIN

Four to thirty-two digits, with the first digit chosen from 1–9 and subsequent digits from 0–9 to prevent a leading zero being lost in numeric input fields. The entropy estimate reflects that format.

• Best for: systems that explicitly require a numeric secret.
• Choose the maximum length accepted by the destination.
• A PIN should not replace a password where alphanumeric values are accepted. Because the first digit cannot be zero, the model is log₂(9) + (n−1)log₂(10), not n log₂(10).

4. Machine token

Sixteen to sixty-four random bytes, encoded as Base64url or hexadecimal. The underlying random bytes provide the entropy; encoding does not add entropy.

• Best for: API and machine-to-machine credentials.
• Scope and provision the token at the destination service; Nuvquerio does not install or revoke it there.
• Store it in a secret manager and keep it out of logs and source control.

5. Recovery-code candidates

Four to twenty independent 128-bit values are presented in a readable hexadecimal grouping. They are candidate recovery codes only; this generator does not register them, enforce one-time redemption, or verify a recovery flow.

• Best for: a destination that supports user-managed recovery codes.
• Import/register them with the target service before relying on them.
• Keep them separate from the account and device they recover.

6. Wi-Fi passphrase

A distinct, configurable password generated with the same browser-side secure randomness and ambiguity exclusions. Compatibility depends on the router and device accepting the selected characters and length.

• Best for: a new wireless network credential.
• Check the router's accepted character set and maximum length.
• Use a separate guest network for visitors where appropriate.

7. UUID v4

A random UUID v4 for identifiers. It is not an authentication credential and must not be treated as an access token or password.

8. Standard Web Crypto keypairs

Where supported by the browser, Nuvquerio can generate Ed25519 signing, X25519 key-agreement, or ECDSA P-256 signing keypairs and export them as JWK. Browser support varies. The private JWK is extractable and displayed to the user; anyone obtaining it can use it. The application does not establish key custody, purpose restrictions, a certificate, an address, or protocol interoperability.

• Best only for development or carefully reviewed application workflows whose format requirements match the generated JWK.
• Not suitable as a wallet key or a substitute for hardware-backed custody.
• Never paste private material into support, chat or issue trackers.

Entropy and threat model

Browser-side Web Crypto supplies cryptographically secure random values in supported secure contexts. Rejection sampling avoids simple modulo bias for bounded random choices. A strong random value can still be exposed by malware, a compromised browser, clipboard monitoring, screen capture or careless storage. Nuvquerio has not claimed an independent cryptographic audit or certification.

Saving to the personal vault

Saving is separate from generation. The browser encrypts the selected item using AES-GCM before sending ciphertext to the API. The service stores the encrypted payload and account metadata. Losing the vault passphrase can make saved content unrecoverable. Avoid saving high-value private keys unless your own custody review explicitly approves the browser and vault workflow.

Primary technical references

These sources explain underlying standards and browser APIs. They do not certify Nuvquerio or establish that its full deployment has been independently audited.

• NIST SP 800-63B-4 — Authentication and Authenticator Management
• NIST SP 800-63-4 implementation FAQs
• NIST SP 800-90A Rev. 1 — Deterministic Random Bit Generators
• MDN Web Crypto: Crypto.getRandomValues()
• MDN Web Crypto: SubtleCrypto.generateKey()
• NIST SP 800-38D — Galois/Counter Mode (GCM)
• BIP-39 English word list (used as vocabulary only)