This password generator uses crypto.getRandomValues, the same cryptographically secure random source browsers use for encryption. Passwords are created on your device and are never sent anywhere or stored.
What makes a password strong?
Length matters more than anything else. Each extra character multiplies the number of possible passwords, so a 16-character password with letters, numbers and symbols would take longer than the age of the universe to brute-force. Use a different password for every site and keep them in a password manager.
The strength meter shows the password’s entropy in bits. Aim for at least 80 bits for important accounts.
Questions
Are these passwords really random?
Yes. They use the browser’s cryptographically secure random number generator, and characters are picked without bias.
Do you store generated passwords?
No. Everything happens in your browser; the page has no server-side component.
How long should my password be?
At least 12 characters, and 16 or more for email, banking and password-manager master passwords.