Question 1

Are the passwords genuinely random?

Accepted Answer

Yes — it uses the browser's crypto.getRandomValues. Math.random is predictable and must never be used to generate passwords.

Question 2

Does length or complexity matter more?

Accepted Answer

Length. A 20-character letters-only password is vastly stronger than an 8-character one with symbols. Complexity rules mostly push people into predictable patterns.

Random Password Generator