Yes. Passwords are produced in your browser using the platform's cryptographic random source (crypto.getRandomValues) and rejection sampling, so the distribution is uniform across the character set you pick. The generated string is never sent to a server, written to a log, or shared with analytics.
No. There is no server-side generation. The generator script has no fetch, no XMLHttpRequest, and no sendBeacon. The only network calls the page makes are to load itself; the password lives only in this tab until you copy it or close the page.
16 characters is a practical minimum for most accounts; 20 is a comfortable default that handles aggressive brute-force resistance without hitting most site length caps. For high-value accounts — banking, email, password manager master password if your manager doesn't handle it — use 24 or 32. The entropy estimate below the output tells you exactly how hard the result is to crack at any given length.
Yes — that is a good use case. Set the length to 32 or 64 characters and include digits and symbols. The entropy estimate (length × log₂ of the alphabet size) shows how much randomness you are getting; 128 bits and up is comfortable for an API key.
Because a remembered password is a stored password, and storing it would break the privacy claim above. Copy the result straight into a password manager (1Password, Bitwarden, your browser's built-in) — that is the right place for long-term storage.
Math.random strong enough for passwords?No, and we do not use it. Math.random is predictable enough that an attacker who sees a few outputs can guess the next one. This generator uses crypto.getRandomValues, the same source the browser uses for things like TLS session keys.
Writing a random password on paper is safer than reusing a weak one — physical security is often easier to reason about than digital. Keep it somewhere secure (not on a sticky note on the monitor), and consider this a temporary measure while you evaluate password managers. Bitwarden is free, open-source, and has been audited; most browsers now have built-in vaults that are a significant improvement over paper.
Yes, once the page has loaded. The generator uses no remote APIs, so it keeps working on a plane, on a locked-down network, or on an air-gapped laptop.