Why you can trust this page
It runs entirely on your machine. The security policy declared at the top of this file tells your browser to refuse every kind of network connection, from any code, for any reason. That is enforcement, not a promise: even a line of malicious code smuggled in here would have no way to send anything out.
It saves nothing. No history, no analytics, no storage of any kind. Close the tab and the password exists only where you pasted it.
The randomness is the operating system’s. Every draw comes from your machine’s cryptographic generator (crypto.getRandomValues), through rejection sampling so no character is ever favoured over another — the classic modulo-bias mistake this page deliberately avoids.
The strength figure is counted, not scored. The bits shown are the exact base-2 logarithm of the number of outputs this generator could have produced with your settings — computed by counting that set, constraint by constraint. No heuristics, no colour-coded guesswork.
You are reading the whole program. This one file is the entire tool and its own source — open it in a text editor, or attach it to an AI and ask what it does. What you check is what runs, because there is only the one file.