How random is the output?

It comes from crypto.getRandomValues(), the same browser primitive used by WebCrypto for key generation. Cryptographically secure, suitable for password use.

How long should my password be?

For random characters: at least 14, 20+ for high-value accounts. For passphrases: 5+ words minimum, 6 words for high-value. The strength tester shows entropy in bits — aim for 80+.

Why exclude ambiguous characters?

When a password has to be typed by humans (router setup, phone OTP, written down), ambiguous pairs (l/1, O/0, I/i) cause errors. Excluding them costs a tiny bit of entropy but cuts typing-mistake rate dramatically.

Are generated passwords stored?

No. They live in the page until you close the tab or click reset. There is no history, no log, no analytics on what was generated.

Why use passphrases instead of random characters?

Equal-strength passphrases are dramatically easier to remember and type. A 6-word EFF passphrase ("correct-horse-battery-staple-foo-bar") has more entropy than a 12-character random password and never requires looking it up.

مولّد كلمات المرور

أنشئ كلمات مرور وعبارات مرور عشوائية آمنة تشفيرياً في المتصفح.

كل شيء يعمل في متصفحك — بلا خادم وبلا تتبّع.