When you search for a "password generator", the first result usually shows a handsome random password on screen and a copy button. Quick, free, easy. But there is one question you should ask before you use it: who else saw that password?
The answer depends on one thing: where was the password generated? If the site sends a request to its server and the server returns the password, then the password passed through a machine you do not control and whose policies you cannot inspect. If the site generates it inside your browser, the password never left your device — but then you need to be sure the code doing the generating is actually running on your machine and not quietly calling home.
In this article we will explain the difference in detail, how to tell which kind of site you are looking at, and how to generate a strong password on your device and store it properly.
What actually happens when you generate a password on an online site?
There are three quite different scenarios, and the page looks identical in all three:
- Server-side generation: the browser sends a request, the server generates the password and returns it. The password exists in the server's memory, possibly in a log or a cache. Even if the site is honest, the password crossed a machine that is not yours.
- Browser-side generation with server-delivered code: the password is generated locally, but the code came from the site. The site can change it at any time, and that code is capable of reading the password and sending it on.
- Browser-side generation with fixed, visible code: the page calls the browser's built-in secure random API (crypto.getRandomValues) and the code that uses it is visible in the page itself.
The first and second scenarios dominate among free online tools, because server-side generation is easier to build and easier to measure. The third is what happens in the Password Generator on TaskDo: the password is generated in the browser through the built-in crypto API, and no network request carries it.
A practical rule: any password tool that asks you to log in or pay before you can see the password, sees the password. That alone is reason enough to look for an alternative.
How to tell whether a site generates locally or on its server
You do not need to be a developer. Three quick checks settle it:
- Open your browser's developer tools (F12), go to the Network tab, then press the generate button. If a new request appears that carries the password back, generation is server-side.
- Disconnect from the internet after the page has loaded, then press generate again. If the tool still produces passwords, generation is local. If it stops, it needs the server.
- Look in the page source for a call to crypto.getRandomValues. Finding it is a strong sign the randomness comes from the browser; its absence alongside network requests points the other way.
The second check is the easiest and the most conclusive. Run it once on any password tool and the result tells you everything you need.
Steps to generate a password on your own device
- Open the Password Generator on TaskDo. The page loads once and the tool then works locally.
- Choose the length. Length is the most important factor in strength, and since a password manager remembers it for you there is no reason to pick a short one.
- Select the character types: uppercase, lowercase, digits, symbols. Add more types when the site allows them, because they widen the space of possibilities.
- If you will type the password by hand somewhere you cannot paste, enable the exclude-similar-characters option (l, 1, O, 0) to reduce typos.
- Press "Generate new passwords" until you get one you like, or generate a batch in one go and pick from it.
- Press "Copy" and put the password straight into your password manager — not into a note, a chat, or a file on your desktop.
The strength meter shown under the password is based on the number of bits of randomness, computed from the length times the logarithm of the alphabet size. It is a mathematical estimate of strength against guessing — it does not mean the password is safe if you reuse it on ten different sites.
Comparison: local generation, online generation, and typing it yourself
| Criterion | On your device | Online site | Typed by hand |
|---|---|---|---|
| Who sees the password | Only you | You, and possibly the server or its logs | Only you |
| Source of randomness | The browser's crypto API | Usually the server's generator | Your brain — and predictable patterns |
| Guessability | Very low | Low if generation is sound | High: names, dates, common words |
| Needs the internet | No, after the page loads | Yes | No |
| Depends on a third party | No | Yes | No |
| Ease of use | High | High | Low for long passwords |
The takeaway: typing by hand is worst in practice because people drift towards predictable patterns, and an online site solves randomness while adding a trust problem. Generating on your device gives you both advantages.
What actually makes a password strong?
Length beats complexity. A long password of simple letters is harder to guess than a short one stuffed with symbols, because the number of possibilities grows exponentially with each extra character.
- Length first: sixteen characters or more for important accounts — email, banking, and the password manager itself.
- A different password for every site: if one site is breached, the damage stays contained instead of opening all your accounts.
- A password manager: it is what makes "a different password for every site" possible at all. Without one, people fall back to reusing the same password.
- Two-factor authentication: it reduces the value of a stolen password on its own, because a second factor is still required.
Practical habits that protect your accounts
- Do not reuse one password across sites, even a very strong one. Reuse is what turns a small breach into a disaster.
- Change the password immediately when you hear about a breach at that site, rather than waiting for a suspicious login attempt.
- Enable two-factor authentication on your email first — it is the gateway to resetting every other account.
- Be wary of passwords that arrive ready-made in an email or a message: their source is not you, and you do not know who else saw them.
Frequently asked questions
Are the passwords from a password generator really random?
Yes, they are produced with crypto.getRandomValues, the API built into the browser specifically for security-sensitive randomness, not an ordinary random function.
Is the password sent to any server?
No. Generation happens inside the page on your device, the password is never sent or stored, and it disappears when you close the page or generate new ones.
Should I use a long password of simple letters, or a short one with symbols?
The long one with simple letters is stronger in practice, because length expands the space of possibilities faster than adding character types to a short password.
What is the point of excluding similar characters?
Letters and digits such as l, 1, O and 0 are easily confused when typing by hand, so excluding them lowers the chance of typing the password wrong and getting locked out.
Is generating a password on an online site definitely a disaster?
Not necessarily, but it is trust you cannot verify: you cannot see the server code or its logs. Generating locally removes the question instead of asking you to trust.
Is the tool free?
Yes, it is completely free with no sign-up and no account, and it works on any device with a modern browser.
Related tools you may need
Summary
A password is a key, and a key that passed through someone else's machine is not your key alone. Any site that generates a password on its server sees what it hands you — the difference is not in the look or the speed, but in who saw the password on the way.
With the Password Generator on TaskDo you produce genuinely random passwords at the length and character mix you choose, and copy them straight into your password manager — all on your device, with no sign-up and with the password never leaving the browser.