How it works

Passwords come from crypto.getRandomValues, the browser's cryptographically secure random source, with rejection sampling to avoid modulo bias. Every character set you enable is guaranteed to appear at least once, and the result is shuffled so those guaranteed characters don't cluster at the front. Nothing is stored or sent anywhere.