Encryptr's security bits are likely all implemented in the crypton framework. If you search the repo for that function (randomString), you'll see that it's onl

Encryptr's security bits are likely all implemented in the crypton framework. If you search the repo for that function (randomString), you'll see that it's only used in one place: to propose a new password (https://github.com/devgeeks/Encryptr/search?utf8=%E2%9C%93&q=randomString https://github.com/devgeeks/Encryptr/search?utf8=%E2%9C%93&q...). While it'd be best to not have any bias at all, this low bias only assists people trying to brute force passwords created by encryptr. Crypton itself has been audited a couple times by crypto persons, see https://crypton.io/docs/security/audits.html https://crypton.io/docs/security/audits.html (disclaimer: i used to work at spideroak, but neither on crypton nor encryptr. i still think they're all awesome though)