Are Password Generators Safe?

Yes — a browser-based or offline generator is safe. If it runs entirely on your device and makes no network calls, it cannot send your password anywhere. The safety question is really about two things: where the randomness comes from, and where the output goes.

What makes randomness "cryptographically secure"?

Every password generator needs a source of randomness to select characters. Not all random number generators are equal. JavaScript's Math.random() function, for example, is designed for simulations and games — it is fast, reproducible, and explicitly not suitable for security purposes. If a generator uses Math.random(), its output can be predicted by an attacker who knows when you generated the password and a few properties of your browser's implementation.

A cryptographically secure pseudo-random number generator (CSPRNG) has two key properties: its output is statistically indistinguishable from true randomness, and it is computationally infeasible to predict future or past output even with complete knowledge of previous outputs. Modern browsers expose a CSPRNG through the Web Cryptography API: window.crypto.getRandomValues(). This function draws entropy from your operating system's secure random source — the same source used for TLS handshakes and key generation.

Any reputable browser-based generator will use crypto.getRandomValues(). You can verify this by inspecting the source code of the page, which is straightforward if it is a plain static site with no minification.

Server-side generators: the important distinction

A server-side generator — one where you click a button, a request goes to a server, and a password comes back — has a fundamentally different security profile. The server generates the password, which means it could in principle log it. Even a trustworthy operator creates a record in transit. The connection may be encrypted, but the server process itself sees the plaintext password before it reaches you.

This does not mean server-side generators are necessarily malicious. Most are not. But it does mean you are relying on the operator's honesty and the security of their infrastructure. For a browser-based generator, the trust requirement is much lower: you only need to trust that the browser API works as documented, which is public, audited, and standardised.

What browser-based means in practice

A browser-based generator is one where all computation happens within the browser tab. You can test this yourself: load the page, then turn off your internet connection (put your device into aeroplane mode), then use the generator. If it continues to work identically, it is browser-based. If it fails or returns an error, it is making server calls.

Browser-based generators also work offline once the page has loaded. You can save the HTML file to your desktop and open it directly — no server involved at all. This is useful for air-gapped environments or for people who want to verify exactly what code is running.

Risks that remain

Even a correctly implemented browser-based generator has some residual risk considerations:

Compromised browser extensions. A malicious or compromised browser extension with broad permissions can read and modify any page, including the output of a generator. If you are generating passwords for high-security accounts, consider doing so in a browser profile with no extensions installed.

Compromised hosting. If the page you are using is served from a web server and that server is compromised, an attacker could replace the legitimate generator code with a version that exfiltrates output. Mitigations include checking the page source, using a well-known and audited tool, or using an offline copy.

Clipboard exposure. After you copy a generated password, it sits in your clipboard until you paste it or copy something else. On shared devices, or devices with clipboard-reading software, this creates a window of exposure. Clear the clipboard after pasting.

Screen recording and shoulder surfing. A strong password displayed on screen can be read by anyone watching. This is a physical security concern rather than a technical one, but it is worth noting for high-value passwords.

What to look for in a trustworthy generator

When evaluating any password generator, consider the following:

• Source of randomness: Does it explicitly use crypto.getRandomValues()? Can you verify this in the source?
• Network behaviour: Does the page make any network requests when generating? (Use your browser's developer tools, Network tab, to check.)
• Offline capability: Does it work with no internet connection?
• Open code: Can you read the generation logic? Is it simple enough to verify?
• No sign-up required: A generator that requires an account to function has no legitimate reason to do so — generating a password requires no server resources.

Comparing generator types

To summarise the trust model across different types:

• Browser-based, client-side only: Lowest trust requirement. Only requires trusting the browser API and the integrity of the page source.
• Password manager's built-in generator: Very safe. Runs locally within the manager application, which is typically audited and open-source. The generated password is automatically saved.
• Server-side generator: Requires trusting the operator and their infrastructure. Acceptable for casual use; not ideal for high-value accounts.
• Command-line tool (e.g., pwgen, openssl rand): Excellent, if you use a secure option. Runs entirely locally, no network involved, draws from the OS entropy pool directly.

For most people, a reputable browser-based generator or their password manager's built-in tool is the right choice. The generator on this site uses crypto.getRandomValues() exclusively and makes no network requests during generation.