It is when the website never sees the password. This page has no server side at all: the passwords are made by a script running in your browser, and the page never sends them anywhere. You can check by switching off your internet connection after the page loads — it keeps working.

With the crypto.getRandomValues function built into your browser, which draws on your operating system’s secure random number generator — the one it uses for encryption keys. It is not Math.random, which is predictable and was never meant for this. Numbers are picked without the slight favouritism a simple remainder would give some characters.

Longer beats cleverer. Sixteen characters of all four kinds is out of reach of any guessing attack today. Use 20 or more for anything that guards your money, your email, or the password manager itself. The bar under the list shows roughly how hard the password is to guess.

Random characters are the strongest for their length, and the right pick when a password manager types it for you. Words are the one to pick when you have to type it yourself, on a TV or a phone, or read it out to somebody: five common words is about as hard to guess as ten random characters. Pronounceable makes up words that do not exist, so you can say them but nobody can find them in a dictionary.

Per letter, no — every letter is a little more predictable, so it needs to be longer. The bar under the list counts the real figure for what was made, so you can make it long enough and see for yourself. Forty-five letters of pronounceable password is well beyond anything that can be guessed.

So you can pick one you like the look of. They are all equally strong. On a phone you get one at a time; press the button for another.

Not in your head and not on a sticky note: use a password manager, and a different password for every site. Then a leak at one website cannot open your accounts anywhere else.