Is it safe to use an online password generator?

The question that actually decides it

Not "is this site reputable?" but: does the password come from your browser, or from their server? If a server generates it, that server saw your password. It may not log it. It may be run by careful people. But the secret existed, in plaintext, on a machine you do not control and cannot inspect, and it travelled back to you over a wire. No privacy policy converts that into a guarantee. If your browser generates it, the value never had to exist anywhere else — and that is a property you can verify rather than a promise you have to believe.

How to tell, in five seconds

Turn off your wifi and press generate. A client-side generator keeps working. A server-side one cannot. That single test cuts through every claim on every one of these sites, including ours — try it on this page right now.

The thorough version: open your browser's developer tools, go to the Network tab, and press generate. You should see no request. On this site you will see none at generation time; on page load you will see our self-hosted, cookie-less analytics, which counts page views and which generator type gets copied, and never a generated value. We would rather tell you that than claim a zero we do not have.

This is not hypothetical

The second-ranking result for "random password generator" today is RANDOM.ORG, which generates server-side — and to its considerable credit, it says so plainly and advises you not to use it for anything important: its own guidance is that the best practice is not to let anyone but yourself generate your most important passwords. That is an honest site giving correct advice about its own architecture. Take it: the advice is right, and the reason it is right is precisely the one above. Most sites in the same position simply don't mention it.

The residual risk, stated plainly

Client-side generation does not make the question disappear, it moves it. You are trusting that the JavaScript this page served you does what it claims — and the page is re-fetched every visit, so "I checked it last month" is not a proof. A malicious operator, or anyone who compromises the DNS or the CDN, could serve different code tomorrow. This is a real limit and you should hear it from us rather than discover it: it is exactly why the SSH page tells you to prefer ssh-keygen for a production key, and why we will never publish a crypto-wallet seed phrase generator. The threat model scales with the value of the secret.

So what should you do?

For everyday passwords, use your password manager's built-in generator — it is client-side, it is audited, and it fills the password in for you, which also protects you from phishing. That advice costs us traffic and it is still the right advice. Use a site like this one when you need a shape a manager does not offer: a hex secret, a base64 key, a JWT signing secret, a UUID. For a secret protecting something irreplaceable, generate it locally with a tool you installed. And whatever you pick — try the wifi test first.