Each character is drawn from window.crypto.getRandomValues — the browser's cryptographically secure random source, the same one used for TLS session keys. That is far stronger than Math.random and matches the entropy expected by password managers and security audits.

For most accounts a 16-character password with uppercase, lowercase, numbers and symbols comfortably exceeds 80 bits of entropy and resists offline cracking. Vault master passwords and root credentials benefit from 24+ characters; throwaway burner accounts can use fewer.

Strength is estimated as length × log₂(character pool size), expressed in bits. Anything above ~80 bits is considered safe against offline brute force for the foreseeable future. Removing character classes shrinks the pool, so the bit count drops accordingly.

In theory yes, but the probability is astronomically small for any reasonable length. A 16-character mixed-class password has roughly 10^31 possible values — the chance of accidental collision is far smaller than the chance of a hardware failure.

Enable "Exclude similar" (i, l, 1, L, o, 0, O) when the password will be transcribed by hand or read over the phone to avoid mix-ups. Enable "Exclude ambiguous" ({} [] () /\ '"`,;:.) when the password must paste cleanly into terminals or shell scripts.

No. Generation happens entirely on your device and recent passwords live in memory until you reload the tab. Nothing is sent over the network, nothing is logged and nothing is cached.