Is It Safe to Use an Online Password Generator?

It comes down to one question: is the password created on your device, or on somebody else’s computer and then sent to you? If it is generated in your browser and never transmitted, an online generator is as safe as an offline one. If a server made it, a password you believe only you have seen has existed, however briefly, somewhere you cannot inspect.

You do not have to take anyone’s word for which kind you are looking at. You can check in about thirty seconds.

How to tell where the password was made

The simplest test needs no technical knowledge at all. Load the page, turn off your internet connection, and press the button. If a password still appears, it was made on your device, because there was nothing left to ask. If it fails, it was not.

The more precise test is the network panel in your browser’s developer tools. Open it, clear it, then generate a password and watch. A generator that runs locally produces no new requests at all. One that fires a request the moment you click has sent something, received something, or both.

• No requests when you click: generated locally, and nothing left your device.
• A request on every click: the password, or the settings that produced it, went somewhere.
• Requests that continue while you sit still: analytics or advertising, which is ordinary, but worth knowing about.

The risk that has nothing to do with the network

A generator can run entirely in your browser and still produce weak passwords, and this failure is invisible: the output looks exactly as random as the real thing. It comes down to which source of randomness the page used.

// Predictable. Fast, seeded, never meant for secrets.
Math.random();

// Cryptographically secure. The one that belongs here.
crypto.getRandomValues(new Uint32Array(1));

The first is a convenience function for shuffling a list or picking a colour. Its output comes from an algorithm whose internal state can be reconstructed by an observer who has seen enough of its results, which makes passwords built from it far weaker than their length suggests. The second is provided by the operating system for exactly this purpose. Both are one line, and only one of them belongs anywhere near a password.

The subtler mistake inside the correct version

Even with a secure source, folding a random number down to a character with the remainder operator introduces bias, because the range rarely divides evenly by the size of the alphabet. Characters near the start of the alphabet then appear slightly more often than the rest. The effect is small and does not make a password guessable by itself, but it is measurable and avoidable, which makes it a fair signal of how carefully the rest was done.

When not to use an online generator at all

If you already use a password manager, use the generator built into it. Not because web generators are unsafe, but because the manager creates the password and stores it in a single step, with no moment where the value sits in a clipboard or a browser tab. Every copy and paste is one more opportunity for something else to read it.

The same applies to the generator built into most modern browsers when a signup form asks for a password. Fewer steps, fewer places for the value to end up.

A web generator is genuinely the right tool for the cases those two do not cover: a password for something that is not a website, a key or token for a configuration file, a value you need on a machine where you have not signed in to anything, or a batch of passwords you are about to hand to someone else.

A short checklist

1. Confirm nothing is sent, by disconnecting or by watching the network panel.
2. Prefer a page served over HTTPS, so what loaded is what the author wrote.
3. Generate a fresh password rather than reusing one you were shown earlier.
4. Paste it straight into the account and into your manager, then clear the clipboard.
5. Never type a password you already use into any page offering to rate it.

The generator on this site runs entirely in your browser and draws from the operating system’s secure random source, without bias in the reduction step. You do not have to believe that: disconnect and press the button.