Strong passwords, made on your device
Everything is generated inside your browser with the operating system's cryptographic random generator. Nothing you create here is ever sent anywhere: no server, no cookies, no analytics. Turn off your internet connection and the page keeps working.
Why you can trust this page
- The random numbers come from
crypto.getRandomValues(), the browser's cryptographically secure generator, fed by your operating system. Not fromMath.random(). - Values are mapped to characters with rejection sampling, so every character is exactly as likely as any other (no “modulo bias”).
- There is no server-side code at all. The site is a handful of static files; after they load, the page makes no network request.
- No cookies, no local storage, no analytics, no fonts or scripts from third parties. The strict Content-Security-Policy sent by the server forbids them.
Verify it yourself
- Open your browser's developer tools (F12), go to the Network tab, then generate passwords: no request appears.
- Load the page once, switch your device to airplane mode, reload: it still works.