Security
This page describes exactly how password and PIN generation works on this site, in enough technical detail to be independently verified.
How passwords are generated
Every password and PIN is built using window.crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator. Each character is selected using rejection sampling, which discards out-of-range values so that every character in the chosen pool has an exactly equal chance of being picked — there is no modulo bias.
Is the password sent to a server?
No. There is no backend involved in generating a password. The entire process — reading your settings, drawing random values, assembling the result — runs in JavaScript inside your browser tab.
Is the password stored?
No, unless you explicitly copy it somewhere outside this site. Generated values are not written to localStorage, sessionStorage, cookies, or any database. Closing or refreshing the tab discards the password completely.
Does analytics receive my password?
No. Any analytics events on this site record only configuration choices — for example, password length or which character types were enabled — never the generated password, PIN, or passphrase itself.
Does the generator use Math.random()?
No. Math.random() is a general-purpose pseudorandom function that is not designed to resist prediction and is unsuitable for security-sensitive generation. This site uses only the Web Crypto API.
Can the site see generated passwords?
No, assuming the implementation remains entirely client-side as described above. You can verify this yourself: open your browser's developer tools, generate a password, and inspect the Network tab — no request is made — and Application/Storage tabs — nothing new is written.
What we recommend you verify yourself
- Disconnect from the internet and confirm the generator still works.
- Open DevTools → Network while generating passwords; no requests should fire.
- Open DevTools → Application → Local Storage / Cookies; no generated value should appear.
- Check the page URL after generating; the password never appears in it.
- Read the source directly: the full code is open source on GitHub, so you don't have to take any of the above on faith.