Why the random source matters
A password is only as unguessable as the randomness behind it. Math.random() is a fast pseudo-random generator seeded per tab; it is not designed to resist prediction, and researchers have demonstrated recovering its internal state from a handful of outputs. A generator built on it produces passwords that look random and are not.
This tool uses crypto.getRandomValues, the browser's cryptographically secure source, and rejection-samples so that every character in the alphabet is equally likely. (The obvious random % alphabet.length introduces a small bias toward the earlier characters whenever the alphabet does not divide evenly into 256.)
Length beats complexity
Adding a character to a password multiplies the search space by the size of the alphabet. Adding a character class only widens the alphabet. In practice, a 20-character lowercase password is far stronger than an 8-character one with symbols, digits and mixed case — and much easier to type.
The entropy figure above makes this concrete. It is the base-2 logarithm of the number of possible passwords, so each extra bit doubles the work an attacker must do. Below about 45 bits is weak against modern hardware; above 80 bits is beyond brute force.
Composition rules do more harm than good
Rules of the "must contain one uppercase, one digit and one symbol" kind reliably produce Password1!. NIST's current guidance recommends against imposing them, favouring length and a check against known-breached passwords instead. This generator can guarantee one character from each selected class where a system demands it, but the length slider is the control that matters.
Where to keep them
A generator solves creating a password; it does not solve remembering one. The safest place is a password manager, which can generate, store and fill them — and will happily do the generating too. Use this tool when you need a password outside that flow.