How I Built a Free Password Generator That Never Sends Your Passwords Anywhere

Most password generators have a problem nobody talks about: you type "generate" and your brand-new password travels to somebody's server. You can't see it happening, you can't prove it didn't, and the whole point of the password was that only you should know it.

So when I built the password generator on toolsofweb.com, I set one rule before writing a single line of code: the password must never leave your device. No upload, no API call, no analytics event containing it. Here's how that works, and what I learned building it.

The one decision that matters: where randomness comes from

Every password generator needs random numbers. JavaScript gives you two very different sources, and picking the wrong one quietly ruins everything.

Math.random() is the one most tutorials reach for. It's fast and easy — and completely wrong for passwords. It's a pseudo-random generator seeded by the browser, designed for games and animations, not secrets. Its output can be predicted if an attacker observes enough values.

The right source is the Web Crypto API: crypto.getRandomValues(). It pulls from the operating system's cryptographically secure random number generator — the same source your OS uses for encryption keys. The difference in code is tiny:

// Don't do this for passwords
const bad = Math.floor(Math.random() * charset.length);

// Do this instead
const array = new Uint32Array(1);
crypto.getRandomValues(array);
const index = array[0] % charset.length;

There's one subtlety worth knowing: using the modulo operator directly introduces a tiny bias when the charset length doesn't divide evenly into 2^32. For a 94-character set the bias is negligible in practice, but the careful approach is rejection sampling — throw away any random value above the largest multiple of the charset size and draw again. It's a few extra lines, and it's the kind of detail that separates a toy from a tool people can trust.

How much randomness is "enough"?

A password's strength is measured in bits of entropy, and the math is simple:

entropy = length × log₂(charset size)

A 12-character password from all 94 printable ASCII characters gives about 78 bits. A 16-character one gives about 105 bits. At 78 bits, even a billion guesses per second would need billions of years. At 40 bits — say, an 8-character password using only lowercase letters — the same attacker finishes in hours.

That's why the generator defaults to 16 characters with uppercase, lowercase, numbers, and symbols all switched on, and why the length slider goes up to 64. Longer is always better, and the cost of a long password is zero when a password manager remembers it for you.

Try it yourself: Password Generator

The strength meter (and why most of them lie)

Almost every strength meter you've seen is really a pattern matcher in disguise. It checks length, character variety, and a few famous bad passwords, then paints a bar green and calls it a day. That's how "P@ssw0rd123!" gets rated "strong" — it ticks every box while being one of the first guesses in every cracking dictionary.

A more honest meter does two things:

1. Calculates real entropy from length and charset size, as above.
2. Checks against known-bad patterns — common passwords, keyboard walks like qwerty, repeated characters, and dates — and downgrades the score when it finds them, no matter how "complex" the characters look.

The goal isn't a perfect score. It's a meter that tells you the truth even when the truth is annoying.

Passphrases: the option most generators forget

A random string like K7#mQ9!zX2@ is strong and completely unmemorable. For the one or two passwords you actually have to type yourself — your password manager's master password, for example — a passphrase is better.

That's why the tool also includes a Diceware-style passphrase option: it picks words at random from a word list and joins them, like correct horse battery staple. Four random words from a 7,776-word list gives about 51 bits of entropy, and six words gives about 77 — comparable to a strong random password, but something a human can actually remember.

If you prefer passphrases, here's the dedicated tool: Diceware Passphrase Generator

Everything happens in your browser — and you can prove it

"Runs 100% in your browser" is easy to claim. Here's how to check it yourself:

1. Open the generator and turn on your browser's network tab (F12 → Network).
2. Generate a dozen passwords, toggle every option, copy a few.
3. Watch the network tab: nothing leaves. No requests at all after the page loads.

You can even disconnect from Wi-Fi after the page loads and it keeps working — there's no server to reach. The same approach powers the other tools on the site, like the Hash Generator and the UUID Generator.

Three things I got wrong along the way

1. Copy-to-clipboard felt like a footnote. It isn't. A generator that makes a great password but makes copying it awkward is a generator people abandon. The copy button uses the async Clipboard API with a fallback for older browsers, and it confirms with a visible "Copied" state — because silent failure here means someone retypes a 16-character password by hand and gets it wrong.

2. Ambiguous characters are a real UX problem. O vs 0, l vs 1, I vs | — when a password is read off a screen or written on paper, these cause real lockouts. The generator has an option to exclude lookalike characters, and honestly it should be on by default for passwords people might ever read.

3. "Exclude symbols" needs care. Some sites reject symbols, so the option exists — but turning symbols off shrinks the charset from 94 to 62, and the entropy display updates live to show what that costs. If you drop symbols, add length to compensate: a 20-character letters-and-numbers password beats a 12-character one with symbols.

A practical rule for your own passwords

If you take one thing from this article, make it this: one unique password per site, generated randomly, stored in a password manager. Reusing a password across sites is how one small breach becomes all of your accounts. A generator solves the "unique and random" half — a manager solves the "remembering them" half.

And if you're curious about the math behind it, the site's guide goes deeper: Password Generator & Strength Guide

Try it

The generator is free, with no sign-up and no limits: Password Generator — toolsofweb.com

Everything runs on your device. Your passwords never leave it. That's not a feature — it's the whole point.