Is it safe to use an online password generator?
It depends on one thing you can check yourself: whether the password is made in your browser or made on a server and sent to you. Open the network panel before you press generate, then, once the page has loaded, disconnect and generate again. Two checks, under a minute.
Why where it's generated is the whole question
A generator that runs in your browser builds the password in the tab, using the browser's own cryptographic random number generator, and nothing leaves the machine.
A generator that runs on a server builds it somewhere else and transmits it to you. Whatever the site's policy says, that password has existed in a process, and possibly in a log, on hardware you don't control. It may well be handled responsibly. You can't tell, and you don't have to accept the risk when the alternative is free.
What a generated password is worth, in numbers
Strength for a generated password is a number you can work out. Our password generator draws from 75 characters (26 lowercase, 26 uppercase, 10 digits and 13 symbols), so each character is one of 75 equally likely choices and adds log2(75) bits, about 6.23. Its default length of 20 gives 20 × log2(75) = 124.6 bits, or about 3.2 × 10^37 possible passwords. Cut it to 12 characters and you are at 74.7 bits. Each character you remove divides the number of possible passwords by 75.
That figure holds only because a random process did the choosing, and it assumes an attacker knows every setting you picked. It also says nothing about where the password was made. A 124.6-bit password generated on a server has exactly the same bits as one made in your browser. The difference is that a copy of it existed somewhere else first.
How do you check without trusting the copy?
Open the browser's network panel before you press generate. This is the check that answers the question directly. What you're looking for is a request fired at the moment of generation. The page's own scripts loading beforehand are not that.
Here is what the difference looks like. On a server-side generator, a new row appears in the list at the moment you press the button, usually of type fetch or xhr, and its response contains the password you are about to see on screen. On our password generator, the password is drawn in the tab with crypto.getRandomValues. Press Generate five times in a row with the panel open and no new request appears. The requests you will see there arrive as the page loads: its own files, and Google Analytics.
Then, with the page already loaded, disconnect and generate again. If it still works, generation is happening in your browser. If it doesn't, that's a reason to look harder at the network panel rather than a verdict on its own, because a page can also fail simply because it hadn't finished loading.
Look at what else is on the page. Third-party advertising and analytics scripts in the same document as a password field aren't, by themselves, evidence that anything was sent, and they're a smaller concern than the generation question. They tell a third party you visited the page, not what appeared on it. Worth knowing about; not the thing that decides the question.
A padlock in the address bar tells you the connection is encrypted. It tells you nothing about who receives the data at the other end.
The risk most people get backwards
Most people worry about the generator and ignore what happens next. A password generated perfectly and then pasted into a chat message, an email to yourself, or a note file isn't secret any more. The weakest point in the chain is usually the handoff. Generate straight into a password manager where you can, and treat the clipboard as something other applications can read.
The clipboard can also keep a history. On Windows, clipboard history (Windows logo key + V) holds up to 25 copied entries. It clears them when you restart the PC, except any you pinned, and if Clipboard history across your devices is turned on, it syncs them through your Microsoft account, according to Microsoft's support page "Using the clipboard". A password you copy is one of those entries until newer copies push it out or the PC restarts, and if sync is on, copies may also sit on your other devices. If you use clipboard history, paste the password into your manager right away, and never pin it.
Common questions
When is a generator the wrong tool?
When a human has to type the password regularly. A device login or a disk encryption passphrase made of random symbols gets written on a note, which is worse than a weaker password nobody writes down. Several random words are easier to type and can be made just as hard to guess by adding words.
How long should a generated password be?
At least 15 characters, and 20 if the site allows it. NIST SP 800-63B-4, the US federal password guideline, requires at least 15 characters when a password is the only login factor, and recommends allowing at least 64. From the 75 characters our password generator uses, 15 characters is 93.4 bits and 20 is 124.6. For anything you'll only ever paste, length costs you nothing, so the real limit is the site's maximum, not your patience.
What does Benchvale do?
Our password generator and passphrase generator run entirely in your browser. Nothing you generate or type is sent to us. That's the same claim every tool on this site makes, and the checks above are the ones we'd want a reader to run on us.
Related
Is it safe to paste JSON into an online formatter asks the same question about data you paste in rather than a secret generated for you, and the password strength checker explains what makes a password hard to guess in the first place. How we build tools is the sitewide version of the same network-tab check.