Where the randomness comes from
The generator calls crypto.getRandomValues, the browser's cryptographically secure generator, which is seeded by the operating system. It does not use Math.random, whose output is predictable enough to be reconstructed. Each character needs a number between zero and the pool size, and a plain remainder operation on a 32-bit value would make some characters very slightly more likely than others.
To avoid that, the code rejects any random value above the largest exact multiple of the pool size and draws again. The same routine picks one character from each ticked set, fills the remaining positions from the combined pool, and then shuffles the result so the guaranteed characters can land anywhere in the string.
What the entropy number means
Entropy in bits is the base-2 logarithm of how many passwords the settings can produce. Every extra bit doubles that count. The panel computes length times log2 of the pool size and labels the result: Weak under 40 bits, Fair from 40, Strong from 60 and Very strong from 80. A 12-character password from the full pool is 78 bits. 13 characters cross into Very strong.
The figure is honest only because the characters are random. A 12-character password a person invents has the same length and far less entropy, since people reuse words, dates and patterns. The number also ignores the one-of-each-type rule, which removes a small fraction of the possible strings and makes no practical difference at normal lengths.
Length does more than extra symbols
Letters and digits alone give a pool of 62, or about 5.95 bits per character. Adding the 27 symbols raises the pool to 89 and each character to about 6.48 bits, a gain of roughly half a bit. One extra character adds about six bits. So a 16-character password with symbols has 104 bits, and an 18-character password without them has 107.
That helps when a site refuses symbols or mangles them: untick Symbols and add two or three characters instead of fighting the form. Exclude look-alikes removes I, l, 1, O, 0 and o, which shrinks the full pool from 89 to 83 and costs about two bits at 20 characters. It is a fair trade for anything you will read aloud or type from paper.
Settings for awkward password rules
Password rules differ from site to site, and the options cover the common ones. The list regenerates the moment any option changes, so set everything first and copy afterwards. A password you meant to keep is gone once the slider moves.
If you untick every type, or exclude every character of the ticked types, the page shows Select at least one character type and no passwords. A set that your exclusions empty completely is dropped without a message, so look at the Character pool count if the output seems short on variety.
- Site rejects certain symbols: type them into Exclude characters
- Maximum length: set the slider to the site's limit
- No symbols allowed: untick Symbols and add a few characters of length
- Numeric PIN: tick Numbers only; six digits is 20 bits, labelled Weak
- Several accounts at once: set How many to 10 or 20 and use Copy all
After you copy a password
Nothing is kept. The passwords live in the page until you reload, regenerate or close the tab, and no request carries them anywhere. Paste the one you chose into a password manager and let it fill the login form, because a 20-character random string is not meant to be remembered. Use a different password for every account, so one leaked site cannot open another.
The generator does not create word-based passphrases and does not test passwords you already have. The password strength checker does the second job. If you are on the other side, storing passwords for an application, they should be hashed with bcrypt or PBKDF2, which the password encryption tool demonstrates.