When users create crypto wallets, seeds, passphrases, passwords, etc., often, they use different types of generators. In this post, we compare three types of generators:
-random passwords generators;
-dynamic (deterministic) passwords generators;
-dynamical (deterministic) passwords generators.
1. Random passwords generators
-How it works?
Uses random entropy/generator/device to build unpredictable strings.
-Storage Need
High. Requires a database/vault or password manager.
-Access
Requires cloud syncing or local file backups.
-Risk profile
Vulnerable if the central encrypted vault is breached or a master password of the vault is compromised. Random generators may have “low entropy” problem, which leads to compromised passwords, crypto wallets, data, etc. Some famous such cases are:
Coldcard Hardware Wallet Flaw (2021–2026): A firmware error inadvertently bypassed hardware-backed true random number generation in favor of a flawed deterministic sequence. This weak entropy generation caused multiple hardware wallet instances to output weak or overlapping private keys, leading to loses over $130 millions from compromised crypto wallets.
CryptoJS Weak RNG Drains (2026):Security researchers identified at least $5.7 million in digital asset thefts. A weak random number generator function (CryptoJS.lib.WordArray.random()) supplied insufficient entropy for recovery-phrase generation across several smaller crypto wallet applications, including Bexo Wallet and Bitcoin Libre.
Kaspersky Password Manager (2021): It had a vulnerability in its password generator caused by a weak, low-entropy random number generator (RNG). Discovered by security researcher Jean-Baptiste Bédrune, the manager used the current system time (in seconds) as the sole seed for a Mersenne Twister random number generator. Because the time in seconds was the only source of entropy, any instance of the software running anywhere in the world would generate the exact same password at any given second.
Randstorm Era Web Wallets (2011–2015): Certain older web browser environments lacked robust native cryptographic APIs, forcing client-side scripts to fall back on weak Math.random implementations or poorly seeded PRNGs (often relying on simple timestamps), leading to the compromise of early Bitcoin private keys.
Android SecureRandom Bug (2013): A flaw in Android's Java cryptographic architecture caused SecureRandom to fail to initialize or block properly under race conditions. This generated predictable sequences that compromised various Android-based Bitcoin wallets and SSH credentials.
Boot-Time Embedded Device Keys (2012): Security research famously uncovered that thousands of network routers, firewalls, and IoT devices generated their permanent RSA and SSH keys immediately upon first boot. Because the operating systems had gathered virtually zero environmental entropy right after startup, different devices generated overlapping or easily predictable keys, allowing mass remote compromise across multiple manufacturers.
Sony PlayStation 3 ECDSA Hack (2010): Sony used a static or catastrophically low-entropy "random" value (nonce) for signing software updates via the ECDSA algorithm. Because the signature algorithm requires a unique random number for every single signing operation and it was reused instead, hackers were able to mathematically derive Sony's private master signing keys and completely break the console's firmware security.
Debian OpenSSL Vulnerability (2008): A packaging bug in Debian-based Linux distributions stripped out the code feeding environmental noise into the OpenSSL pseudo-random number generator, limiting the entropy source entirely to the process ID. As a consensus on Information Security Stack Exchange notes, this capped all generated SSH keys, TLS certificates, and OpenVPN keys to just 32,767 total possibilities, allowing attackers to easily enumerate and compromise affected servers.
Netscape Navigator SSL Flaw (1995): Early versions of Netscape's browser seeded their SSL PRNG using only the time of day, process ID, and parent process ID. Attackers could guess these predictable variables to reconstruct session encryption keys.
2. Dynamic passwords generators
-How it works?
Re-computes using a cryptographic hash (e.g., SHA-256).
-Storage Need
Zero. Passwords are never saved anywhere.
-Access
Regenerate on any device using your inputs.
-Risk profile
Vulnerable if your master password/seed/PIN is exposed.
3. Dynamical passwords generators
-How it works?
Re-computes using advanced mathematical algorithms.
-Storage Need
Zero. Passwords are never saved anywhere.
-Access
Regenerate on any device using your inputs.
-Risk profile
Low risk due to eliminations of a single point of failure in dynamic passwords generators (master password/seed/PIN), by diversifying into multiple input parameters.
Modern variants of dynamic parametric passwords generators, with advanced mathematical algorithms, move closer to dynamical passwords generators (DPGs). This means that in the near future the boundary between them may disappear.
There are two types of DPGs: public and private. Public DPGs are free and anyone can access them. Private DPGs offer two additional lines of security defenses, by restricting accesses to private DPGs to legitimate users/customers and generating different outputs. Each private DPG generates different outputs for the same inputs. In other words, if two persons enter the same input parameters in their private DPGs then outputs will be different for these users.
Summary table
P.S. 1. Some popular public DPGs:
2. To create BIP39 12/24 words seeds/passphrases combine DPGs with these converters:
https://www.dynpass.online/tools/bip39/12w.html
https://www.dynpass.online/tools/bip39/24w.html
3. Advantages of dynamical passwords generators vs traditional passwords managers
