Are Online Password Generators Safe?
A password generated on a server has, by definition, been known to that server. That single sentence is the whole issue. Whether an online password generator is safe depends entirely on where the random number is produced — in your browser, or on someone else's computer — and most sites do not tell you.
The good news is that you can check in about thirty seconds, and the answer is usually visible without any technical knowledge.
Where is the password actually generated?
A safe generator produces the password in your browser using JavaScript's crypto API. An unsafe one produces it on a server and sends it to you over the network.
The practical difference:
- Client-side: the password exists only in your browser's memory and in whatever you paste it into. No third party ever holds it.
- Server-side: the password is created on a machine you do not control, transmitted to you, and may appear in server logs, request logs, caches, backups or an analytics trace — none of which you can audit.
Transport encryption does not fix this. HTTPS protects the password from anyone between you and the server. It does nothing about the server itself, which is the party that generated the value in the first place.
How can I tell which kind a generator is?
Open your browser's developer tools, switch to the Network tab, and click generate. If a request goes out and a password comes back, it was made on a server. If nothing happens on the network, it was made locally.
That check takes half a minute and requires no expertise — you are looking for the presence or absence of a request, not reading its contents.
A stronger test: load the page, disconnect from the internet, and click generate. A client-side generator keeps working. A server-side one cannot.
Filevane's Password Generator passes both. The site's Content-Security-Policy permits six network destinations in total, none of which is involved in generating a password — and the browser itself enforces that, so it is not a promise, it is a constraint.
What makes a random password actually random?
The generator must use a cryptographically secure random number source — in a browser, that is crypto.getRandomValues() and not Math.random(). This distinction matters more than it sounds.
Math.random() is designed to be fast and statistically even, not unpredictable. Its output can be predicted from previous values in some implementations, which is entirely fine for shuffling a playlist and completely unacceptable for a credential.
You cannot inspect this from the outside, which is a real limitation of any generator you did not write. What you can do is prefer tools that state which they use, and prefer client-side generation, because a locally generated password from a weak source is still a smaller exposure than a strong one that a server has seen.
What actually makes a password strong?
Length, overwhelmingly. A 16-character random password is far stronger than a 10-character one stuffed with symbols.
The arithmetic is straightforward. Each additional character multiplies the number of possibilities by the size of the alphabet, so length compounds while complexity merely adds:
| Password | Approximate entropy |
|---|---|
P@ss1! (6 chars, all classes) |
~39 bits — weak |
horsebattery (12 chars, lowercase) |
~56 bits |
| 12 random chars, mixed | ~71 bits |
| 16 random chars, mixed | ~95 bits — comfortable |
| 6 random words | ~77 bits, and memorable |
Anything above roughly 80 bits is beyond practical brute force with current hardware, which is why 16 characters is a sensible default and 20 is better for anything that matters.
Should I use a passphrase instead?
For anything you have to type or dictate, yes. A passphrase of five or six random words is comparable in strength to a 16-character random string and vastly easier to enter on a phone, a TV or over the telephone.
violet-harbor-clock-42-ridge is stronger than Xk9#pQ2! and you can actually read it aloud.
The critical word is random. A phrase you chose because it was memorable is not random — quotations, song lyrics and personal facts are all in the attack dictionaries. The words have to be selected by the generator, not by you.
Do I need one uppercase, one number and one symbol?
No, and current guidance actively advises against forcing it. NIST SP 800-63B recommends against composition rules of that kind, because they measurably reduce the search space rather than expand it.
The reason is behavioural. Told to add a capital and a number, almost everyone capitalises the first letter and appends 1 or 2026, and attackers know this. password becomes Password1! — which is longer and barely harder to guess.
Where a site imposes such rules you have to comply, and a good generator will let you. But do not treat complexity as a substitute for length.
What about the password manager's built-in generator?
Use it — it is generally the best option available. A password manager generates locally, stores the result immediately, and removes the copy-paste step where passwords most often leak into clipboards, chat windows and screenshots.
An online generator is the right tool when you do not have a manager to hand, when you need a credential for something outside it (a database seed, an API key, a temporary share), or when you want a passphrase in a specific format.
Does it matter if I reuse a strong password?
Yes — and reuse is a bigger practical risk than weakness. A 20-character random password used on five sites is compromised on all five the moment any one of them is breached, because credential-stuffing attacks simply replay leaked pairs against other services.
A unique password per site defeats this entirely, regardless of how strong each one is. That is the single highest-value habit in this entire subject, and it is why a password manager matters more than any generator.
What about hashing and storing passwords?
If you are a developer storing passwords rather than choosing one, the rules are different. Use a deliberately slow algorithm designed for the job — bcrypt, scrypt or Argon2 — never a general-purpose hash like MD5 or SHA-256, which are fast by design and therefore fast to attack.
BCrypt Generator produces and verifies bcrypt hashes locally. Note that bcrypt silently truncates input beyond 72 bytes, and that its cost factor is a power of two — raising it by one doubles the work.
Generate a password now
Password Generator — adjustable length and character set, cryptographically secure randomness, generated entirely in your browser. Nothing is transmitted, and it keeps working with your connection switched off.
Need a different shape of secret? Random String Generator for API keys and tokens, UUID Generator for identifiers, BCrypt Generator for password hashes.
Tools used in this guide
Frequently asked questions
Are online password generators safe to use?
It depends entirely on where the password is generated. A generator that produces the value in your browser is safe, because the password exists only in your own memory. A generator that produces it on a server has, by definition, disclosed that password to the server, where it may appear in request logs, caches or backups you cannot audit. HTTPS does not help, because it protects the password from parties between you and the server, not from the server itself.
How can I tell if a password generator runs in my browser?
Open developer tools, switch to the Network tab and click generate. If a request goes out and a password comes back, it was created on a server. If nothing appears on the network, it was created locally. A stronger version of the test is to load the page, disconnect from the internet and click generate — a client-side generator keeps working and a server-side one cannot.
What makes a password strong?
Length, far more than complexity. Each additional character multiplies the number of possible passwords, while adding a symbol merely widens the alphabet slightly. A 16-character random password carries roughly 95 bits of entropy, which is beyond practical brute force; a 6-character password with every character class included carries about 39 bits and is weak. Aim for 16 characters minimum, or 20 for anything important.
Is a passphrase better than a random password?
For anything you have to type or dictate, yes. Five or six randomly chosen words give comparable strength to a 16-character random string and are far easier to enter on a phone or read aloud. The essential condition is that the generator picks the words, not you — quotations, lyrics and personal facts all appear in attack dictionaries and are not random.
Do I need one uppercase letter, one number and one symbol?
No. NIST SP 800-63B advises against forced composition rules because they reduce the effective search space rather than expanding it. Told to add a capital and a digit, most people capitalise the first letter and append a 1 or the current year, which attackers anticipate. Comply where a site demands it, but do not treat complexity as a substitute for length.
Is it safe to reuse a strong password across sites?
No, and reuse is a bigger practical risk than weakness. Credential-stuffing attacks replay username and password pairs leaked from one breach against other services, so a 20-character password used on five sites is compromised on all five the moment any one is breached. A unique password per site defeats this regardless of individual strength.
Which hashing algorithm should I use to store passwords?
A deliberately slow one designed for the purpose: bcrypt, scrypt or Argon2. General-purpose hashes such as MD5 and SHA-256 are built to be fast, which makes them fast to attack by brute force and unsuitable for passwords. If you use bcrypt, note that it silently truncates input beyond 72 bytes and that its cost factor is a power of two, so raising it by one doubles the computation.