How Our Password Generator Works: Verify It Yourself

What Happens When You Click Generate

1. The page asks your browser for random numbers through crypto.getRandomValues(), the Web Crypto API. It returns cryptographically strong random values from a generator that the specification recommends seeding from the operating system's entropy source.
2. Each character, word or digit is chosen with rejection sampling: random 32-bit values that would make some choices slightly more likely than others are thrown away and redrawn. The result is exactly uniform.
3. If you require each character type, a whole candidate password is drawn and rejected if a type is missing. No character type is ever placed in a fixed position, and every valid password is exactly as likely as any other.
4. The password is written into the page. That is the end of its journey: no request is made, nothing is written to cookies, localStorage or any other storage, nothing goes into the address bar, and the password is never logged.

If the Web Crypto API is unavailable, the generator refuses to run. There is no fallback to Math.random(), which is not designed for security. This is the code that does it, taken from the module at build time:

function getRandomValues(): <T extends Uint8Array | Uint32Array>(array: T) => T {  const source = globalThis.crypto;  if (typeof source?.getRandomValues !== 'function') {    throw new Error('Secure random numbers are unavailable: crypto.getRandomValues() is missing.');  }  return (array) => source.getRandomValues(array);} /** * Returns `count` independent integers in [0, maxExclusive), every value exactly equally likely. * * Rejection sampling: 32-bit draws at or above the largest multiple of maxExclusive are * discarded and redrawn, so `value % maxExclusive` carries no modulo bias. Values are drawn * in batches (one CSPRNG call per batch rather than per value) for speed. */export function randomInts(maxExclusive: number, count: number): number[] {  if (!Number.isInteger(maxExclusive) || maxExclusive < 1 || maxExclusive > RANGE) {    throw new RangeError(`maxExclusive must be an integer in [1, 2^32], got ${maxExclusive}`);  }  if (!Number.isInteger(count) || count < 0) {    throw new RangeError(`count must be a non-negative integer, got ${count}`);  }  const fill = getRandomValues();  const limit = RANGE - (RANGE % maxExclusive);  const buffer = new Uint32Array(Math.min(count, MAX_DRAWS_PER_CALL));  const result: number[] = [];  while (result.length < count) {    const draws = buffer.subarray(0, Math.min(count - result.length, MAX_DRAWS_PER_CALL));    fill(draws);    for (const value of draws) if (value < limit) result.push(value % maxExclusive);  }  return result;}

The complete generation module is 11 small files (1020 lines including comments) with no dependencies. The same code powers the password generator, the passphrase generator, the PIN generator and the random values of the developer tools.

Why the Content Security Policy Matters

A promise that "we don't send your password anywhere" is only as good as the code on the page, and pages commonly load dozens of third-party scripts: analytics, ads, A/B testing, chat widgets, session-replay tools that record keystrokes. Any one of them could read a password field. The Content Security Policy is the browser-enforced rule that stops that from being possible here:

• script-src 'self' plus fingerprints - the browser only runs scripts from this domain, the exact inline scripts we ship, and the three named analytics providers. No other third-party script can execute.
• connect-src 'self', plus the analytics providers' own endpoints - scripts cannot use fetch, XHR, WebSockets or beacons to send data anywhere else.
• form-action 'none' - no form on the site can submit anywhere.
• frame-ancestors 'none' - no other site can embed these pages in a frame to overlay or spy on them.

This means the only analytics that can load is Google Analytics - no other third-party scripts, ads or tracking pixels can run at all. Fonts, wordlists and dictionaries are self-hosted for the same reason.

Clipboard Auto-Clear

When you copy a generated password, a 30-second countdown starts and the clipboard is then overwritten with an empty value. That limits how long other apps and websites can read it. Three honest caveats: the browser only allows the overwrite while the tab is focused (you will see a message if it could not clear); if you copy something else on the page during the countdown, we stop, so we never wipe your own copy; and clipboard-history features in some operating systems and apps keep their own copy. On Windows, check Clipboard history settings; on macOS, check any clipboard manager you have installed.

What We Cannot Protect Against

Client-side generation removes the server from the picture. It cannot make an unsafe device safe:

• Malware or a malicious browser extension can read any page, including this one. Extensions with "read and change all your data on all websites" permission deserve scrutiny.
• Someone looking at your screen. The strength checker hides your input - and the breakdown of it - by default for this reason.
• Where you store the password afterwards. Use a reputable password manager.

For the maths behind the strength numbers, see the password entropy calculator.

Trust & Privacy FAQs