> Yes, and by that it appears random. Which is exactly what we want and what password managers provide. Good sources of randomness, that aren't susceptible to

> Yes, and by that it appears random. Which is exactly what we want and what password managers provide. Good sources of randomness, that aren't susceptible to side-channel attacks have only really appeared in browsers (Crypto.getRandomValues) in March of _this_ year. Random is only good if it is a decent CRNG, and we haven't had time to roadtest if we can rely on that yet. Bad random is predictable, in which case you're removing security. > Are you sure? Yes. You're _adding_ a platform that can be attacked, but not introducing anything that is more secure than what is already possible.