Password generator

It comes from crypto.getRandomValues, your platform cryptographic random source, and each character is chosen by rejection sampling rather than a modulo, so no character in the pool is slightly more likely than another. Math.random is not used anywhere in this tool, and no seed, counter or pattern is involved.

Length 20, with lowercase, uppercase, digits and symbols all switched on, and excludeAmbiguous off. The symbol set adds 25 punctuation characters, so the default pool is 87 characters. Twenty characters drawn uniformly from a pool of 87 works out at roughly 128 bits, and the length field takes any positive whole number.

Because every character is drawn from the combined pool independently. Enabling a class puts its characters in the pool; it does not guarantee at least one appears, and the tool blurb says so. If a site demands one of each, generate again or edit a character in, accepting that you lose a little entropy by doing so.

It removes the characters that look alike in many fonts: zero, capital O, one, lowercase L, capital I and the vertical bar. The bar is not in the symbol set to begin with, so in practice it strips five characters from the pool, which makes each character carry slightly less entropy. Useful when a password has to be read aloud or copied by hand.

One of two checks failed. A length that is not a positive whole number gives "length must be a positive whole number". Turning every class off, or turning on excludeAmbiguous when only digits remain, empties the pool and it tells you to enable at least one character class instead of returning something weaker than you asked for.

No. It is generated in this tab and exists only on the page in front of you. Nothing is uploaded, there is no account, and closing the tab is the end of it, so copy it into your password manager before you leave.