[ncallaway]

> might not strictly follow the length that you set

Why on earth not? It’s very easy for a computer to check the length of a string, and compare that to a number, there’s absolutely no reason and no excuse for deferring that to the user.

The end user should have every expectation that a generated password will conform to the minimum length setting, and other password settings that are exposed.

Failing to generate passwords that meet the promised criteria is a bug, and not something users should need to have “common sense awareness of”.