1 · You choose the rules
Length, character types (lowercase, uppercase, digits, symbols), exclusions (similar, sequential, repeated), and whether it must start with a letter. These are constraints, not templates — every result is still random.
2 · Randomness comes from the browser
The generator reads from crypto.getRandomValues, the same cryptographic source your browser uses for encryption. Each character is picked from the allowed set with uniform probability, using rejection sampling so that no character is favoured over another.
3 · Strength is measurable
Each character contributes log₂(pool size) bits of entropy. A 22-character password drawn from a 94-character pool therefore carries roughly 144 bits — enough that even a fast GPU guessing a billion combinations per second would need longer than the age of the universe.
4 · Nothing leaves the tab
The password is built in memory, rendered on screen, and copied to your clipboard. It is never sent, logged, or stored — not even by us. Close the tab and it is gone.
Why you can verify it
- The site is a static page: no server-side logic, no accounts.
- The source code is published, so the page you run can be compared against it.
- Generating a password triggers no network request — check the Network tab and see for yourself.