We're going to create a password that looks something like

if-fad-pie-crete-wheel  or
 Gkfan,Wu6ko,Jddfe  or
 G55v3:irony:fiat:Mzexu.

The goal here is passwords that are: (a) Secure for the particular use. (b) Not super long -- some sites/apps limit the length significantly And (c) easy to read off of one place and type into another, which is sometimes needed.

We build the password in three steps:

1. Select the separator (punctuation) that comes between the words and/or strings. You can pick "None" for no punctuation; that works nice with the strings that start with a capital letter. (If you don't pick a separator, a random one is chosen.)
2. Select words and/or strings from a table of randomly-selected ones, until the password is long enough for the particular use.
3. Cut the password from its box and paste it where it's needed.

What does it mean for a password to have enough bits of entropy to be "long enough for the particuar use"?

•   less than 65 bits: Not adequate if you're concerned about someone accessing this site/app, or using it to masquerade as you.
•   65 bits or more: Could be cracked in less than a year by a government, but it's plenty adequate for a website where you have no money or consequential personal information at risk.
•   80 bits or more: Secure for most things.
•   90 bits or more: Very secure: adequate for things that would be costly if hacked, like bank accounts or credit cards or important email accounts.

Caveats:

1. We assume that the window.crypto.getRandomValues() function in your browser actually returns cryptographically-strong random numbers, like it's supposed to.
2. We assume this computer/phone/device has not been subverted by malware which would control it or eavesdrop on its actions.

Notes:

• The words are chosen from the Diceware wordlist. The characters in the strings are chosen from 'a' through 'z' and '2' through '7', and the string always starts with a capital letter.
• The implementation aims to be lean and rely on no external libraries so it's easy to know for yourself what it's doing.