Randomness comes only from crypto.getRandomValues. Each character or word is picked with rejection sampling, so every choice is exactly equally likely (no modulo bias). Passwords are never saved — only your settings are remembered.
Entropy is the number of bits an attacker must guess, assuming they know your settings. With “at least one of each” the count excludes passwords that miss a set, so it is exact. Aim for 70+ bits for accounts, 100+ for master passwords and keys.
Passphrase picks words from a built-in list of 2,048 short English words (11 bits each), so 5 words ≈ 55 bits, 7 words ≈ 77 bits. Capitalizing adds no entropy; “add a number” puts one digit on a random word.
Look-alikes removes I l 1 O 0 o so passwords are easier to read and type.
Click a password to copy it. Shortcuts: Ctrl/⌘+Enter copies all, Alt+R regenerates.