The generator on this webpage is based on five samples from the Javascript PRNG (all from the same state, so effectively only 32 bits of entropy or so), plus th

The generator on this webpage is based on five samples from the Javascript PRNG (all from the same state, so effectively only 32 bits of entropy or so), plus the browser's window size and client viewport size, and mouse movements. Prior to sampling mouse movements, we're talking about around 64 bits of entropy here; probably less if your window is maximized (since there are a small number of popular window sizes). I wouldn't trust the grid that's shown on initial load, that's for sure. Also note that it's frequently said that anyone can make a cryptosystem secure enough that the creator themselves cannot break it. So I wouldn't fully trust this without further analysis. I don't really like how much key material is exposed to the sites, though... But that's not really the point. The real problem is that this is a _lot of work_. The real problem with passwords is not that generating them is hard. There's no end to systems to generate passwords. Here's an easy one: Print out a list of 6^4 common English words. Roll 4 dice to select one. Repeat four times. There's your password. No, the real problem is compliance. Remembering passwords is hard, so people don't bother. Regenerating passwords each time with this "Off The Grid" system is also hard. So people won't bother. It is _far better_ to have a password management app than to halfheartedly use a system like this but eventually give up and go back to using the same password everywhere.