Password Generator

Every character is chosen using the browser's crypto.getRandomValues(), the same cryptographically secure random source used for things like encryption keys, not the much weaker Math.random(), which is predictable enough in some engines to be reconstructed from past output. Character selection also uses rejection sampling instead of a plain modulo, so every allowed character has exactly equal probability with no bias toward the start of the character set.

Entropy in bits is log2(character set size) multiplied by the password length, it measures how many guesses an attacker who knows your settings (but not the password itself) would need on average to find it by brute force. Each extra bit doubles that number of guesses, so going from 40 to 60 bits is not a 50% improvement, it is roughly a million times harder.

Those characters look nearly identical in many fonts, which matters if you ever need to read the password aloud, type it from a printed copy, or key it into a device without a reliable font. Excluding them shrinks the character set slightly (and so slightly lowers entropy for the same length), a small, usually worthwhile tradeoff for passwords you will not always copy-paste.

Some login forms reject passwords that are not a mix of character types even when the overall length and randomness are strong. With this on, the generator guarantees at least one character from every type you selected before filling the rest randomly, then shuffles the whole result so the guaranteed characters are not predictably placed at the start.

Yes, each password in a batch is generated independently with its own fresh random bytes, so knowing one password in the batch gives no information about the others. Using a different, independently generated password per account (rather than variations of one password) is exactly what protects you if one site you use is ever breached.

No, generation happens entirely in your browser with JavaScript, nothing is sent to a server, and the page keeps no history of past values beyond a locally stored character-count summary (never the password itself) for the history panel on this page.