How this works
Passwords are generated using the Web Crypto API's crypto.getRandomValues(),
which provides cryptographically strong random bytes. There's no server involved — the
password is created in your browser and never transmitted anywhere.
Entropy and strength
The "bits of entropy" figure tells you how hard a password would be to brute-force: each bit doubles the number of guesses an attacker needs. For most accounts, 60+ bits is solid; 80+ is excellent; above 100 is overkill but harmless. A 16-character password drawing from 94 printable ASCII symbols gives ~105 bits.
Ambiguous characters
If you'll ever have to type or transcribe the password manually, check the "Exclude
ambiguous" option. It removes characters that look similar in many fonts:
capital I, lowercase l, digit 1, capital O,
digit 0. For machine-to-machine use, leave it off to maximize entropy.