Set a length and pick which character types to include, then generate.
No. It's generated using your browser's built-in cryptographic random number generator (crypto.getRandomValues, not the weaker Math.random) and never leaves the page — nothing is sent to a server or logged.
Entropy measures how many possible passwords could result from your chosen length and character set, expressed in bits: entropy = length × log₂(character pool size). Each additional bit doubles the number of guesses an attacker would need to try. As a rough guide, security researchers generally consider under 40 bits weak, 40–60 bits moderate, 60–80 bits strong, and 80+ bits very strong for an offline brute-force scenario. The entropy number is a more honest strength measure than the colored bars some password tools show, because it's calculated directly from the actual math rather than a heuristic guess.
This assumes an offline brute-force attack (the attacker has a stolen password hash and unlimited attempts, no lockouts) at a rate of roughly 10 billion guesses per second — a reasonable estimate for a modern GPU cluster attacking a fast, unsalted hash. It's a worst-case estimate, not a guarantee: a properly salted and slow hash function (like bcrypt or Argon2, which reputable services use) can push real-world cracking time far higher than this raw math suggests, while a poorly secured service could be much faster to breach through means that have nothing to do with password strength at all (phishing, breaches, credential stuffing).
Length matters more than complexity tricks — a longer password with a mix of character types is harder to crack than a short one with symbols swapped in for letters (like "P@ssw0rd", which is actually weak despite looking complex, because it's a well-known substitution pattern attackers check first). Aim for at least 12–16 characters where the site allows it; go to 20+ for anything protecting financial accounts or your password manager's own master password.
It removes characters that are easily confused when handwritten or read aloud — lowercase l, uppercase I, uppercase O, and the digit 0. Turn it on when you'll need to type the password from a printed copy or read it to someone over the phone; leave it off otherwise, since it slightly reduces the character pool and therefore the entropy for the same length.
No — a unique password per site limits the damage if any one service is breached; reused passwords are exactly what credential-stuffing attacks exploit, trying a leaked password-and-email pair against hundreds of other sites automatically. A password manager (built into most browsers, or a dedicated app) can store unique generated passwords so you don't have to remember each one.
The underlying math of entropy and brute-force resistance is universal, but compliance standards differ — US NIST guidelines (SP 800-63B) now actually recommend length over forced complexity and periodic rotation, a shift from older policy; EU GDPR doesn't mandate specific password rules but requires "appropriate" security measures, leaving specifics to each organization; India's IT Act and sector-specific RBI guidelines for banking impose their own minimum complexity rules for regulated services. In practice, follow whatever the specific site requires, but default to length and uniqueness regardless of jurisdiction — those two factors matter more than any specific policy.
The generation itself is safe — it runs entirely in your browser using a cryptographically secure random function, and nothing is transmitted or logged. That said, always type or paste it directly into the site you're creating the password for, store it in a password manager rather than a plain text file, and never share it elsewhere.
Worked example: a 12-character password using only lowercase letters has about 26¹² ≈ 95 quadrillion combinations (≈56 bits of entropy); adding uppercase, numbers, and symbols to the same length pushes the pool to roughly 94 characters, giving about 4.8×10²³ combinations (≈79 bits) — length and character variety compound together, which is exactly what the entropy and crack-time readouts above are showing in real time as you adjust the settings.
Encoding is not encryption — the Base64 Converter explains why a Base64 string protects nothing, and the URL Encoder covers percent-encoding for query strings. For network addressing, see the IP Subnet Calculator. Hex strings are the usual format for keys and salts rather than passwords; convert or check one with the hexadecimal converter.