Password Generator

They come from crypto.getRandomValues(), the browser's cryptographically secure random source, and are generated with rejection sampling so every character in the alphabet is equally likely. Generation happens locally; no password is ever transmitted.

Entropy matters more than any character-class rule. With the full alphabet enabled, 16 characters gives around 104 bits, which is far beyond offline brute force. If you must memorise it, a five- or six-word passphrase reaches similar entropy and is much easier to type.

An offline attack at 10 billion guesses per second against a fast hash, which models an attacker who has stolen a password database. It is a rough order-of-magnitude figure, not a guarantee.