Is it safe to use an online password generator?
It depends on one thing you can check yourself: whether the password is made in your browser or made on a server and sent to you. Open the network panel before you press generate, then, once the page has loaded, disconnect and generate again. Two checks, under a minute.
Why where it's generated is the whole question
A generator that runs in your browser builds the password in the tab, using the browser's own cryptographic random number generator, and nothing leaves the machine.
A generator that runs on a server builds it somewhere else and transmits it to you. Whatever the site's policy says, that password has existed in a process, and possibly in a log, on hardware you don't control. It may well be handled responsibly. You can't tell, and you don't have to accept the risk when the alternative is free.
How do you check without trusting the copy?
Open the browser's network panel before you press generate. This is the check that answers the question directly. What you're looking for is a request fired at the moment of generation. The page's own scripts loading beforehand are not that.
Then, with the page already loaded, disconnect and generate again. If it still works, generation is happening in your browser. If it doesn't, that's a reason to look harder at the network panel rather than a verdict on its own, because a page can also fail simply because it hadn't finished loading.
Look at what else is on the page. Third-party advertising and analytics scripts in the same document as a password field aren't, by themselves, evidence that anything was sent, and they're a smaller concern than the generation question. They tell a third party you visited the page, not what appeared on it. Worth knowing about; not the thing that decides the question.
A padlock in the address bar tells you the connection is encrypted. It tells you nothing about who receives the data at the other end.
The risk most people get backwards
Most people worry about the generator and ignore what happens next. A password generated perfectly and then pasted into a chat message, an email to yourself, or a note file isn't secret any more. The weakest point in the chain is usually the handoff. Generate straight into a password manager where you can, and treat the clipboard as something other applications can read.
Common questions
When is a generator the wrong tool?
When a human has to type the password regularly. A device login or a disk encryption passphrase made of random symbols gets written on a note, which is worse than a weaker password nobody writes down. Several random words are easier to type and can be made just as hard to guess by adding words.
How long should a generated password be?
For anything you'll only ever paste, length is the cheapest strength available and costs you nothing. The constraint is the site's maximum, not your patience.
What does Benchvale do?
Our password generator and passphrase generator run entirely in your browser. Nothing is sent to us. That's the same claim every tool on this site makes, and the checks above are the ones we'd want a reader to run on us.
Related
Is it safe to paste JSON into an online formatter asks the same question about data you paste in rather than a secret generated for you, and the password strength checker explains what makes a password hard to guess in the first place. How we build tools is the sitewide version of the same network-tab check.