About the password generator
Passwords are generated in your browser using the Web Crypto API, the same cryptographically secure random source browsers use for real cryptographic work. They are never transmitted, never logged and never stored. The site records that a password was generated so we know the tool gets used; the password itself is not part of that record and never touches a server.
Set the length and choose which character classes to include: lowercase, uppercase, digits and symbols. You can exclude ambiguous characters — l, I, 1, O, 0 — which is worth doing for anything you will read aloud or type from a printout. There is also an option to require at least one character from every selected class, which satisfies sites with rigid composition rules.
Passphrase mode joins several random words with a separator. Each word drawn from this tool's list adds about 9.2 bits of entropy, so a six-word passphrase is roughly 55 bits and an eight-word one roughly 73. That is the honest arithmetic: passphrases are easier to type and remember, but their strength comes from length, and four words is not enough. The generator shows the entropy for whatever you pick, so you never have to take the claim on trust.
The strength meter shows estimated entropy in bits and a plain-language read on how long an offline attack would take at current hardware speeds. Anything above 80 bits is comfortable for a personal account; above 100 bits is appropriate for a password manager master password or anything protecting money.
The important part is not the password, it is where you keep it. Generate a unique one per site and store them in a password manager. Reuse is what turns one breach into ten compromised accounts.