The Question That Matters: Where Is the Password Made?
A password generator is only as trustworthy as the place where the password is created. There are two designs:
- Server-side generators create the password on the website's computer and send it to you. The site could, in principle, see or log it, and it travels across the network.
- Browser-side generators create the password on your own device, with code that runs in your browser. The password never needs to leave your machine.
Browser-side generation is the safer design, because no one else has to be trusted with the password. It is the design all of our generators use.
How Good Is the Randomness?
Even a browser-side generator can be weak if it uses the wrong random number source. Browsers provide two:
Math.random()is a non-cryptographic source of random numbers. It is not designed for security, and its output can be predictable.crypto.getRandomValues()returns cryptographically strong random values. MDN explains that it uses a pseudo-random number generator seeded with a value with enough entropy, and that the algorithm may vary between browsers but is suitable for cryptographic purposes.
A trustworthy generator uses the second. It should also pick characters without bias. When a random number is squeezed into a range that does not divide evenly, some characters become slightly more likely, which is called modulo bias. Careful generators avoid it with rejection sampling.
A Five-Minute Test for Any Generator
- Check the address bar. The page should load over HTTPS.
- Open your browser's developer tools (press F12, or right-click and choose Inspect) and go to the Network tab.
- Generate several passwords and watch the Network tab. A browser-side generator should not send a request each time you click Generate. Requests for page assets or analytics are normal. A request carrying your password or settings is not.
- Look at the address. The generated password should never appear in the page URL, because URLs are stored in browser history and server logs.
- Try it offline. Load the page, turn on airplane mode, and generate again. If it still works, the password is being made on your device.
- Search the page source (press Ctrl+U, then Ctrl+F) for getRandomValues. If you find Math.random being used to pick password characters, choose another generator.
Signs of a Trustworthy Generator, and Warning Signs
| Good sign | Warning sign |
|---|---|
| Generates in the browser and says so clearly | Does not say where the password is made |
Uses crypto.getRandomValues() | Uses Math.random() for password characters |
| Works without an account or email | Requires sign-up before generating |
| Nothing is sent when you click Generate | Network requests carry your password or settings |
| Explains its method and has a privacy policy | No explanation, no policy, no contact details |
| Lets you adjust length and character sets | Always gives short, fixed-format passwords |
What We Checked in Our Own Generators
We reviewed the code of the generator pages on this site on 7 October 2026. The password-generating pages draw
their randomness from crypto.getRandomValues(), and several apply rejection sampling to avoid
modulo bias. The page code contains no fetch, XMLHttpRequest or beacon calls, so
generating a password does not make a network request. Like many sites, we use Google Analytics to count visits,
which is described in our privacy policy.
You should not have to take our word for any of this. Run the five-minute test above on our
Strong Password Generator, and on any other tool you use.
Safe Generation Is Only Part of the Job
- Store the password safely. A perfect password saved in a notes file or a browser tab is still at risk. Use a password manager.
- Make it long. Length matters most. See our crack-time table.
- Keep it unique. Reuse is the weakness behind most account takeovers. See the data breach checklist.
- Do not paste it into chat or email. Treat it like cash.
Sources
- MDN: Crypto.getRandomValues(): states that the method returns cryptographically strong random values, that it uses a pseudo-random number generator seeded with enough entropy, and that Math.random is a non-cryptographic source. Read on 7 October 2026.