Passwords they can't crack.

Correct. Every character is produced by window.crypto.getRandomValues() client-side. There is no network call associated with generation — you can verify this yourself by opening DevTools Network tab and watching as you generate. We never see the output, so we couldn't log it even if we wanted to.

Random for anything a password manager will remember for you (max security, hard to type). Passphrase for anything you'll type repeatedly or need to recite (phone lock, BitLocker, master password). Pronounceable as a middle ground — useful for temporary accounts or when you might need to dictate a password over the phone.

60 bits is the modern floor for anything important — that's resistant to offline cracking by a well-funded adversary for at least years. 80+ is excellent and well within the generator's defaults. Below 40 is only safe against online-throttled attacks — assume anything that rate-limits logins rather than giving attackers a hashed dump.

Entropy scales linearly with length and logarithmically with character-set size. Going from 8 → 12 characters adds roughly 26 bits of entropy (lowercase + digits); adding symbols to an 8-character password only adds ~6 bits. Long beats exotic every time — that's why passphrases with four common words beat cryptic 8-char passwords despite looking weaker.

They're order-of-magnitude, not precise. We assume bcrypt/Argon2id-class hashing (what responsible sites use) and ~2024 GPU costs. For sites still using plain SHA-256 or MD5 (poor choices, but they exist), attackers crack 100–1000× faster, so shift the times accordingly. For any site that still uses plain hashing, assume 40-bit passwords are already gone.

Functionally nearly identical — same crypto primitives, same entropy math. Our generator is useful as a standalone, no-install, no-account web page: for quick one-off passwords, for the password to your password manager itself, or when you're on someone else's machine and don't want to install anything. For everyday use, generate inside your password manager where it's immediately stored.