Why the random source matters
The critical part of a password generator is invisible: where the randomness comes from. A generator built on Math.random() produces output that looks random and is not. That function is a deterministic algorithm seeded from a small amount of state, and given a handful of outputs an attacker can reconstruct the generator and predict every password it will ever produce.
This tool uses crypto.getRandomValues(), which draws from the operating system's entropy pool — the same source used for TLS keys. It also uses rejection sampling rather than a modulo, because random % 26 makes the first few letters of the alphabet measurably more likely than the last few.
Reading the entropy number
Entropy in bits is a measure of the search space. Each additional bit doubles the work an attacker must do. A 12-character password using all four character sets is about 79 bits; 20 characters is about 131 bits. Below roughly 60 bits, a well-resourced attacker with stolen password hashes can brute-force offline. Above about 100 bits, the attack is not feasible with any foreseeable hardware.
What actually protects an account
A strong unique password only helps if it is unique. Reuse is what turns one breached site into a dozen compromised accounts, which is the argument for a password manager: it makes generating a different long random password per site the path of least effort. Enable two-factor authentication wherever it is offered — it protects you even if the password does leak.
For random identifiers rather than passwords, see the UUID generator. To produce a one-way digest of a value, see the hash generator.