Can my generated password leak?
No. Generation uses the cryptographically secure crypto.getRandomValues API and completes entirely in your browser, with no network transmission and no storage. The page source is public, so you can verify that no requests are made.
How long should my password be?
Current guidance recommends 16+ characters including digits and symbols. This tool labels 80+ bits of entropy as “Very strong”, a level where brute force is impractical. For important accounts, 20+ characters is a good choice.
Are passphrases weaker than random strings?
Not if you use enough words. Strength is words × log2(vocabulary size), which is exactly what this tool displays. A 6–7 word passphrase rivals a 16-character random string — and you can actually remember it.
Does excluding ambiguous characters weaken the password?
Only slightly (the pool shrinks by a few characters), and the displayed entropy is computed from the reduced pool, so it stays accurate. For passwords that will be typed by hand or read aloud, avoiding mistakes usually outweighs the tiny loss.