What this password generator does
It creates a random password in one click. You choose the length and which kinds of characters to use (lowercase, uppercase, digits, symbols), you can leave out look-alike characters such as I, l, 1, O and 0, and you can ban any specific characters a website refuses. A meter shows how much randomness the result contains.
The password is created inside your browser and shown on your screen. It is not saved, not logged and not sent anywhere. When you reload or close the page, it is gone.
How the passwords are made
Each character is picked with the browser's cryptographically secure random number generator (the Web Crypto function crypto.getRandomValues), the same source that browsers use for security features. The tool never uses the ordinary Math.random, which is not designed to be unpredictable.
Picking at random from a list sounds easy, but a careless version slightly favours some characters. The tool avoids this: it throws away any random number that would make the choice uneven and draws again, so every allowed character is equally likely. It also guarantees at least one character from every group you ticked, then shuffles the result so those guaranteed characters do not sit in predictable places.
Reading the strength meter
Strength is shown in bits of randomness: the length multiplied by the base-2 logarithm of the number of possible characters. Every extra bit doubles the number of guesses an attacker would need. The labels (weak, fair, strong, very strong) are simple bands over that number. They describe passwords generated here, which are random. A password you invented yourself, or one built from words and dates, is much easier to guess than its length suggests.
