Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I usually generate strong passwords using various online tools. Some time ago I mentioned it to a friend of mine and he was shocked that I do such dangerous thing. Is it really so unsafe to generate passwords online? Could there be generated some kind of cookie that tracks where I pasted it?

share|improve this question
Given that there's good offline tools like KeePass there's no reason to take the risk to use an online tool. – Christian Dec 15 '15 at 21:25
What benefit do you think you get from using an online tool versus a local one? – Adam Shostack Dec 15 '15 at 23:19
up vote 13 down vote accepted

No. It is not safe to generate passwords online. Don't do it!

In theory there are some ways that one could perhaps build a password generator that is not so bad (e.g., run it in Javascript, on your local machine, and so forth). However, in practice, there are too many pitfalls that an average user cannot be expected to detect. Consequently, I do not recommend it.

For instance, an average user has no way to vet whether the password generator does indeed ensure that the password never leaves your site. The average user has no way to verify that the web site is not keeping a copy of your password. The average user has no way to verify that the password generation code is using good entropy (and Javascript's Math.random(), which is the obvious thing to use for this purpose, is not a great pseudorandom number generator).

share|improve this answer
All these seem good reasons for security.SE, whose users CAN check those things, to suggest one good website. :) – Nemo Nov 8 '15 at 8:50
@Nemo that's a dangerous proposition. Now you're asking people to trust a site that could go rogue, could be compromised, etc. Better to do it offline. – Ohnana Dec 15 '15 at 22:16
@Ohnana I'm not asking anything. And doing it offline isn't any better if one uses proprietary software. – Nemo Dec 16 '15 at 21:54

Just because a password generator doesn't use JavaScript doesn't mean it's not safe, however it would be easy for the server to store the password sent out with your IP address. If this is a concern it would be easy to change a few characters in the password. The GRC Ultra High Security Password Generator does not use JavaScript but "this page will only allow itself to be displayed over a snoop-proof and proxy-proof high-security SSL connection, and it is marked as having expired back in 1999". Each "instance" of this page has multiple passwords so even if GRC did log them (which I doubt they do) they wouldn't know which one you've chosen to use. If you still want a JavaScript based generator here is one.

share|improve this answer
So this got at least 2 down votes. Anyone care to explain? – Celeritas Apr 23 '14 at 16:22
+1 for mentioning the awesome GRC generator. – Chris Marisic Jul 28 '14 at 17:34

If the password is being generated locally in JavaScript and there is no traffic back to the server, you should be fine.

If the password was being stored in a cookie it would only be viewable from the site that it originated from, due to the same origin policy. You would also be able to detect this by checking your cookies.

Their is the possibility for disclosure of information if you use a bookmarklet such as the one at (JavaScript in a bookmark). The bookmarklet is stored locally, but run in the context of the site you are at, so if there is JavaScript running from that site that is setup to detect your bookmarklet, it could access information that the bookmarklet, uses, prompts for, and generates.

share|improve this answer
"You would also be able to detect this by checking your cookies." how would you do that? – curiousguy Jul 31 '12 at 22:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.