A password generator has a tiny interface and some surprisingly important behavior behind it. My browser experiment provides a length control and options for uppercase letters, lowercase letters, numbers, and symbols.
It also has an option to exclude ambiguous characters. When someone has to read a value from one screen and type it into another, telling a capital I from a lowercase l is not always a fun recreational activity. Making the available character set explicit helps explain what the tool is producing.
The reviewed working copy generates values in the browser using Web Crypto’s random-value API. There is no server-side generation step in that file. That is a concrete implementation detail, not an automatic guarantee that every aspect of the generator has been independently audited.
One subtle point is that selecting a character class adds it to the available pool. It does not require every generated value to include at least one character from each selected class. A site with a strict composition rule may therefore need more than simply checking the matching boxes.
The repository also contains testing and working variants, so the distinction between a source copy and the currently deployed page matters. The hosted shortcut is /pw; I would not assume that every experimental file represents a separate production release.
What interests me about this project is how much clarity can fit into a small tool. The controls should describe what the code really does, and the description should avoid promising more than the implementation establishes. Even a single-button utility benefits from that discipline.