Pick a length and character types and get random passwords built with your browser's cryptographic generator. Nothing leaves the page, and each result comes with its entropy in bits and an estimated brute-force time.
Strength is entropy: length × log2(pool size). Adding length beats adding character types — 20 lowercase letters is stronger than 12 characters drawn from all four sets.
The brute-force estimate assumes an offline GPU attack on a leaked hash at 10 billion guesses per second. Attacks against a live login form are orders of magnitude slower.
Each selected character type is guaranteed at least once, then the whole string is shuffled — leaving the types in a fixed order at the front would shrink the real search space.
Sixteen characters across all four types is about 105 bits, which is out of reach for offline attacks. For accounts that matter, go to 20 or more.
Turn symbols off and add length. Extra characters buy back the entropy you lose from the smaller pool.
No. Generation and display happen in the browser with no network request, and the values disappear when you leave the page — so save the one you keep in a manager.