PRACTICAL GUIDE
Are Online Password Generators Safe?
The answer turns on one question: does the password exist anywhere other than your own browser? How to check, and how to tell good randomness from bad.
Last updated
The question that decides it
There are two ways a website can hand you a password. It can generate one on its server and send it to you, in which case the password has travelled across the network and existed in a system you know nothing about. Or it can send your browser some code, and your own machine generates the value locally, in which case nobody else has ever seen it.
Only the second is defensible for a credential you are about to rely on. Everything else about the tool — how pretty it is, how many options it offers — is secondary to this.
How to check for yourself
Open the Network tab in your browser developer tools before pressing generate. If a request goes out at that moment, the value came from elsewhere or was reported back. If nothing happens, the work was done locally. The blunter version of the same test: turn off your network connection after the page loads and press the button. A local generator carries on working.
Not all randomness is equal
A generator can be perfectly local and still weak. The ordinary random function in most programming languages is designed for speed and statistical spread, not unpredictability — its output can be reconstructed by anyone who works out the seed, which is often derived from the clock.
Passwords need a cryptographically secure source. In a browser that is the Web Crypto API, and it is what our generator uses to draw every character. The difference is invisible in the output and total in its consequences.
Watch for modulo bias
Even with a good random source, converting raw bytes into characters carelessly makes some characters more likely than others, which shrinks the real search space. It is an easy mistake and an invisible one — the passwords still look random. It is one more reason to prefer a generator whose behaviour you can inspect, and to favour length, which gives you margin even if the implementation is imperfect.
What our generator does
It runs entirely in your browser, draws randomness from the Web Crypto API, and lets you set a length from 8 to 64 characters with independent control over lower case, upper case, digits and symbols. The default is 20 characters with everything enabled. The password is never transmitted, never stored, and disappears when you close the tab.
The weakest link is usually what happens next
A perfectly generated password loses all its value if it is then pasted into a chat message, emailed to a colleague, or saved in a notes file that syncs to three devices. Generate it directly into a password manager where possible. If you must share a credential, use the manager's sharing feature or a one-time secret link rather than a channel that keeps a permanent copy.
Frequently asked questions
Could a local generator secretly send my password somewhere?
In principle any page could contain code that does that, which is why the Network tab test is worth doing rather than taking a claim on trust. It is also why a tool that loads no third-party scripts is easier to reason about: there is less code involved and none of it belongs to someone else.
Is a password manager's built-in generator better?
It is the most convenient option, because the password goes straight into the vault without ever being displayed or copied. The quality of the randomness is comparable. If you already use a manager, use its generator.
Do symbols actually make a password stronger?
They enlarge the alphabet, so each character carries slightly more entropy — but adding two more characters achieves more than adding symbols to a short password. Symbols are also worth disabling when a site restricts them or when you will have to type the password on a phone keyboard or a games console.
Is it safe to generate passwords on a shared or work computer?
The generation itself is fine. The surrounding environment is the problem: a managed machine may have monitoring software, and the clipboard is readable by other applications. Generate sensitive credentials on a device you control.