{"id":56,"date":"2026-10-11T09:20:00","date_gmt":"2026-10-11T09:20:00","guid":{"rendered":"https:\/\/www.strongrandompassword.com\/blog\/?p=56"},"modified":"2026-10-08T03:03:02","modified_gmt":"2026-10-08T03:03:02","slug":"is-an-online-password-generator-safe","status":"publish","type":"post","link":"https:\/\/www.strongrandompassword.com\/blog\/is-an-online-password-generator-safe\/","title":{"rendered":"Is an Online Password Generator Safe"},"content":{"rendered":"

TL;DR:<\/strong> An online generator is reasonably safe when it builds the password in your browser, you are on the real site, and you do not send the result through chat or email. It is a poor idea on a public computer you cannot lock, or on a page you reached from an ad you did not mean to click. Generate, store in a manager, and move on. Start from the address you typed yourself: the strong random password generator<\/a>.<\/p>\n

The hotel business center<\/h2>\n

A consultant I met at a conference needed a new password for a staging server before a demo. The laptop battery was dead. He used the hotel business-center PC, searched for a generator, and hit the first ad. The page looked plausible. He generated a string, pasted it into the server panel, and also into a note he mailed to himself. Two weeks later the staging host showed a login from another country. We cannot prove the ad page exfiltrated the password. We can say the path included an unknown site, a shared operating system, and an email copy. Any one of those was enough to throw the secret away. He had treated “it says random” as a security review.<\/p>\n

What a careful visit looks like<\/h2>\n

Type the generator’s address or use your own bookmark. Do not follow a sponsored result when you are about to create a banking password. Confirm the lock icon and the host name before you copy anything. A generator that offers length, numbers, letter case, and symbols, and that shows the result on the page for you to copy, matches the tool you want. A page that demands an account, a browser extension with broad permissions, or your email “to send you the password” is doing a different job.<\/p>\n

    \n
  • Bookmark the real host<\/strong> once, on a machine you trust, and reuse the bookmark.<\/li>\n
  • Skip extensions<\/strong> that promise to generate and also read every page you open.<\/li>\n
  • Do not email the result<\/strong> to yourself as the storage plan.<\/li>\n
  • Prefer your own device<\/strong> over a kiosk, even if the kiosk browser looks clean.<\/li>\n<\/ul>\n

    Local generation matters because the secret does not need to become a server log entry in order to exist. You still copy it with your hands into the manager. That copy step is the part you control.<\/p>\n

    Shared machines remember more than the password field<\/h2>\n

    Even a honest generator leaves the string on screen, possibly in the clipboard, and possibly in the browser’s back-forward cache. On your laptop that is a small issue if you lock the screen. On a library PC it is an invitation. If you ever must generate somewhere shared, copy straight into a manager account that you then sign out of, clear the clipboard by copying a harmless word, close the browser fully, and change the password again from your own machine the same day. Assume the kiosk copy leaked.<\/p>\n

    Shoulder surfing is the low-tech version. A coffee shop seat with a screen facing the room is a bad place to reveal a twenty-character secret in a large font. Generate at home. Fill logins later with the manager, which can mask the value.<\/p>\n

    Clipboard managers and sync<\/h3>\n

    Some utilities keep clipboard history and sync it. A generated password can land in that history beside a grocery list. If you use clipboard history, clear it after you paste into the vault, or paste with a manager that does not need the system clipboard. This is a property of your computer, not of the generator.<\/p>\n

    Ads, look-alike names, and extra downloads<\/h2>\n

    Names that differ by a word or a hyphen are a common trap. The page may still “work,” in the sense that it shows a random-looking string, while also sending that string elsewhere. You will not see the extra request. The defense is boring: your bookmark, not the ad, not a link in a comment, not a mirror. Decline any download. A password generator does not need a new executable to pick characters.<\/p>\n

    If a page urges you to paste your existing passwords “to test their strength,” close it. Strength testers that ask for the real secret are asking for the secret. You can judge length yourself. You do not need to upload the bank password to learn that it is fifteen characters.<\/p>\n

    Corporate laptops and inspection<\/h3>\n

    A work machine may decrypt HTTPS so the company can scan traffic. That is a policy choice, and it means a password you generate there can exist in a log you do not control if the page or an extension misbehaves. Generate personal passwords on a personal device. Use the work machine for work secrets that already belong to that employer, and follow their vault. If a contractor laptop is the only computer you have today, generate the password, move it into your manager, and change it again tonight from home. Delay is acceptable. Leaving the only copy on the contractor image is not.<\/p>\n

    Use it, then stop exposing the result<\/h2>\n

    A normal session is short. Open your bookmark, set the options, copy into the manager, paste into the site, confirm login, clear the clipboard, close the tab. Do that on a device you control. The consultant’s staging password failed a process test, not a randomness test. Randomness was never the weak step. The path the string traveled was.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Use a bookmarked generator on a device you control, and do not send the result through chat, email, or a kiosk.<\/p>\n","protected":false},"author":1,"featured_media":34,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-56","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-generator-tips"],"_links":{"self":[{"href":"https:\/\/www.strongrandompassword.com\/blog\/wp-json\/wp\/v2\/posts\/56","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.strongrandompassword.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.strongrandompassword.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.strongrandompassword.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.strongrandompassword.com\/blog\/wp-json\/wp\/v2\/comments?post=56"}],"version-history":[{"count":1,"href":"https:\/\/www.strongrandompassword.com\/blog\/wp-json\/wp\/v2\/posts\/56\/revisions"}],"predecessor-version":[{"id":57,"href":"https:\/\/www.strongrandompassword.com\/blog\/wp-json\/wp\/v2\/posts\/56\/revisions\/57"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.strongrandompassword.com\/blog\/wp-json\/wp\/v2\/media\/34"}],"wp:attachment":[{"href":"https:\/\/www.strongrandompassword.com\/blog\/wp-json\/wp\/v2\/media?parent=56"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.strongrandompassword.com\/blog\/wp-json\/wp\/v2\/categories?post=56"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.strongrandompassword.com\/blog\/wp-json\/wp\/v2\/tags?post=56"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}