Strong Password Generator

Minimum 12 for normal accounts, 16+ for email and financial accounts. Each extra character doubles crack time. Above 16 is essentially impossible for current hardware.

Removes l, 1, I, 0, O and o (visually similar letters and numbers). Useful when the password will be TYPED — mobile login, reading from a phone, etc. If you'll only paste it, leave off for more entropy.

No. Math.random() isn't cryptographically secure. We use crypto.getRandomValues() from the Web Crypto API, the standard used by security libraries.

Yes, marginally — they expand the search space. But length matters MUCH more. A 20-char letters-only password is safer than an 8-char with symbols. Use both when the service allows.

In a password manager (1Password, Bitwarden, KeePass). Don't write on paper, save in a .txt file, or email yourself. A manager is the only scalable way to keep unique strong passwords across dozens of services.