How to Judge a Password Generator Before You Trust It

A password generator asks for something unusual: trust, extended to a stranger's website, at the exact moment you create a secret. That trust should not be given blindly, but it can be checked. A trustworthy generator has a small number of observable properties, and a suspicious one has red flags that are just as visible. Learning the checks takes a few minutes, and they apply to every generator you will ever meet, not just one. Password Generator is built around the properties described here: cryptographic randomness in the browser, nothing stored, and nothing sent anywhere.

The first check is the random source. Computers cannot easily produce true randomness, so browsers provide a cryptographic random source, usually called WebCrypto, built into the browser itself. A good generator uses that source and says so. A weak generator uses a general-purpose random function designed for games and simulations, not secrets. The difference is invisible in the output — both produce plausible-looking strings — but it matters enormously, because a predictable random source lets an attacker narrow the search space dramatically. A generator that does not name its random source has failed the first check, whatever its output looks like.

Storage and network: the two questions that matter most

The second check is storage. Ask: does this generator remember my passwords? The honest answer for a browser generator should be no, or at most a session-only history that vanishes when the tab closes and is clearly labelled as such. A generator that keeps a permanent history, syncs passwords to an account, or stores them in a way you cannot inspect is holding your secrets for reasons you did not ask for. Check whether there is a history feature at all, whether it can be cleared, and whether it survives a page reload. A session-only history is a convenience; a permanent one is a liability.

The third check is the network. Open the generator, disconnect from the network if you can, or simply watch whether it works without sending anything. A browser generator that creates passwords locally should work entirely offline once the page has loaded, because nothing needs to leave your device. A generator that requires a connection for each password, or that sends the generated password to a server for "strength checking", has introduced a party you never agreed to trust. Strength can be computed locally from length and character set; there is no technical reason to send a password anywhere to assess it.

Red flags that should make you close the tab

Several behaviours are immediate reasons to leave. A generator that asks you to create an account before generating anything is collecting identity alongside secrets for no reason. One that shows advertising inside the generation area, or that overlays the result with promotional content, is optimising for something other than your security. One that generates the same password on every visit, or that offers a small set of "popular" passwords to choose from, is not generating randomly at all. And one that displays a password and then encourages you to share it, email it, or save it to an unprotected location is actively harmful.

A subtler red flag is a generator that never explains itself. Trustworthy tools describe their method in plain language: the random source, the character sets, what the entropy figure means, and what happens to generated passwords. A tool with no explanation, no privacy statement, and no way to verify its claims is asking for blind trust, and blind trust is the wrong basis for a secret. The absence of an explanation is itself information.

Worked example: checking a generator in two minutes

Imagine a fictional user, Sara, evaluating a generator she found through a search, on an invented review site at example.com that recommends it. She runs four checks. First, she reads the page: does it name a cryptographic random source? It does, and it explains that generation happens in the browser. Second, she generates a password, closes the tab, reopens the generator, and looks for any history. There is none, which is the expected result for a no-storage tool. Third, she generates another password with the network disconnected after the page loads, and it still works, confirming nothing is sent per password. Fourth, she checks the entropy display: it changes when she changes the length, and it is labelled as an estimate rather than a certainty.

None of these checks proves the generator's code is flawless — only reading the code could do that, and most users cannot. But together they rule out the common failures: weak randomness, hidden storage, and network exfiltration. A generator that passes all four is behaving the way a trustworthy one should. A generator that fails any one of them should be abandoned, however polished it looks. Sara then generates her own fresh password with the checked tool, stores it in her manager, and never reuses any example pattern shown in a review or article, including this one.

Honest limitations

These checks assess behaviour, not code. A malicious generator could pass the observable checks while doing something hidden, which is why the strongest assurance comes from tools whose code is open or from generators built into a password manager or operating system you already trust. The checks also cannot protect what happens after generation: a good password pasted into a phishing page or an untrustworthy site is compromised regardless of how well it was generated. Judge the generator, then protect the password itself, and use a second factor wherever it is offered. For the site-side half of account safety, see the HTTP security headers guide.

FAQs

Should I trust an online password generator with my passwords?

Only after checking it: a named cryptographic random source, no permanent storage, generation that works without sending anything to a server, and an entropy figure labelled as an estimate. A generator failing any of these should not be used.

What is the difference between cryptographic and ordinary randomness?

Cryptographic randomness comes from a source designed to be unpredictable, provided by the browser or operating system. Ordinary random functions are designed for simulations and games, and their output can be predictable enough for an attacker to exploit.

Does a password generator store my passwords?

A trustworthy browser generator does not, or keeps only a clearly labelled session-only history that vanishes when the tab closes. If a generator keeps a permanent history or syncs passwords to an account, treat that as a reason to look elsewhere.

Why should a generator work offline?

Because generation needs nothing from a server. If a password can be created with the network disconnected after the page loads, nothing is being sent per password. A generator that requires a connection for each password is introducing an unnecessary party.

Once you have a password you trust, protect the documents it guards: Protect PDF adds password protection in your browser, and the Security Header and DNS Checker reviews the sites you will use it on.

human review pending client designation