Password Generator

Yes — it uses the browser's crypto.getRandomValues() API, the same cryptographically secure random number source used by encryption libraries, rather than Math.random() (which is predictable and unsuitable for security purposes). Nothing is sent to a server; the password is generated and stays entirely in your browser.

NIST's current guidance (SP 800-63B) recommends at least 15 characters for most accounts, with longer being better since length matters more than complexity for resisting brute-force attacks. For anything protecting financial data or your primary email, 20+ characters is a reasonable target — especially since a password manager means you never have to type or remember it.

These characters look nearly identical in many fonts — lowercase L, uppercase I, and the digit 1 can be indistinguishable, as can uppercase O and zero. Excluding them matters when a password might be read aloud, handwritten, or typed from a printed copy; it makes no difference when a password manager is copying and pasting it directly.

Yes, without exception. Reusing passwords means a breach at one site — even an unimportant one — compromises every account using that password, a technique called credential stuffing that accounts for a large share of account takeovers. A password manager is what makes unique, long, random passwords practical to use everywhere.

The strength estimate is based on entropy — length combined with how many possible characters are in play (lowercase-only has far fewer possibilities per character than a full mix of upper, lower, numbers, and symbols). It's a reasonable proxy for brute-force resistance but doesn't check whether a password has appeared in a known data breach; consider pairing a strong random password with a breach-checking service for critical accounts.