Question 1

Are generated passwords ever sent anywhere?

Accepted Answer

No. Every password is generated with crypto.getRandomValues() entirely inside your browser tab — never transmitted, logged, or stored anywhere — and disappears the moment you navigate away or reload the page.

Question 2

Why exclude ambiguous characters?

Accepted Answer

Characters like l, I, 1, O, and 0 can look identical in some fonts. Excluding them makes a password easier to type correctly by hand, at the cost of a very slightly smaller character set.

Question 3

How is "strength" calculated?

Accepted Answer

As entropy in bits — length × log2(character set size) — a standard rough proxy for how many guesses a brute-force attack would need. It's not a guarantee against every attack style (e.g. a leaked password reused elsewhere).

Question 4

What password length should I use?

Accepted Answer

For most modern accounts, 16+ characters using all four character types gives comfortable margin against brute-force attacks — go longer if the account allows it.

Question 5

Does adding symbols matter more than length?

Accepted Answer

Length matters more. A longer password with fewer character types is generally stronger than a short one using every type, since entropy scales with both, but length has far more room to grow.

Password Generator

Frequently asked questions