I made a browser-only password generator that never sends passwords to a server

I made a free password generator because I wanted the privacy model to be clear: passwords are generated locally in your browser using the Web Crypto API and are not uploaded or stored.

It lets you choose a length from 6 to 64 characters, select uppercase/lowercase/numbers/symbols, exclude ambiguous characters, and see a rough entropy estimate. The generator uses crypto.getRandomValues() with rejection sampling to avoid modulo bias, ensures each selected character class appears, and then shuffles the result locally.

Try it here: https://getpasswordgenerator.com/

I am looking for practical feedback:

- Is the local-only explanation clear enough before you trust it?

- Are 16 characters and all four character groups a sensible default?

- Is anything confusing or awkward on mobile?

- Are there security or accessibility issues I missed?

It is intentionally simple. I would rather hear what feels untrustworthy or unnecessary than just “nice work.”