How a job interview led me to create Obscura - A password generator with real entropy

Introduction During a recent interview for a Security Software Engineer position, I was given a challenge: create a secure password generator that takes into account real entropy. The interviewer wanted to see how I would approach the problem, and I was excited to take on the challenge. At first, I thought it would be a simple task. I had used password generators before (with Math.Random stuffs), and I assumed it would be easy to create one that was secure. But the conversation quickly steered away from superficial implementations and into deeper, often overlooked topic: entropy—and how most so-called generators don't handle it properly. The challenge The interviewer insisted on entropy being measurable, adjustable, and predictable based on user choice. He wasn't looking for a simple tool that just throws random characters together; he wanted a password generator that would : quantify the information entropy of the generated password, adapt based on character pool constraints (like avoiding duplicates or special characters), prevent common patterns and sequences (e.g., "123" or "qwerty" or "abc"), and still generate passwords that are straightforward to use and robust against brute-force attacks. That got me thinking about how most password generators out there are just glorified random characters generators. My thought process: understanding entropy I started by asking him about the definition of entropy in the context of password generation. He explained that entropy is a measure of uncertainty or randomness in a system. In the case of passwords, it refers to the unpredictability of the password itself. The more unpredictable a password is, the higher its entropy, and the more secure it is against brute-force attacks. (I said to my-self: come on man, you were supposed to make understand the concept not complicate it

Apr 13, 2025 - 22:12

How a job interview led me to create Obscura - A password generator with real entropy

Introduction

During a recent interview for a Security Software Engineer position, I was given a challenge: create a secure password generator that takes into account real entropy. The interviewer wanted to see how I would approach the problem, and I was excited to take on the challenge.

At first, I thought it would be a simple task. I had used password generators before (with Math.Random stuffs), and I assumed it would be easy to create one that was secure. But the conversation quickly steered away from superficial implementations and into deeper, often overlooked topic: entropy—and how most so-called generators don't handle it properly.

The challenge

The interviewer insisted on entropy being measurable, adjustable, and predictable based on user choice. He wasn't looking for a simple tool that just throws random characters together; he wanted a password generator that would :

quantify the information entropy of the generated password,
adapt based on character pool constraints (like avoiding duplicates or special characters),
prevent common patterns and sequences (e.g., "123" or "qwerty" or "abc"),
and still generate passwords that are straightforward to use and robust against brute-force attacks.

That got me thinking about how most password generators out there are just glorified random characters generators.

My thought process: understanding entropy

I started by asking him about the definition of entropy in the context of password generation.

He explained that entropy is a measure of uncertainty or randomness in a system. In the case of passwords, it refers to the unpredictability of the password itself.
The more unpredictable a password is, the higher its entropy, and the more secure it is against brute-force attacks. (I said to my-self: come on man, you were supposed to make understand the concept not complicate it