Is a password generated in a browser actually random?

Yes, when it uses the Web Crypto API, which is what these tools use. It draws from the operating system's cryptographically secure random source, the same one used for TLS keys, rather than from Math.random, which is predictable and unsuitable for anything secret.

Could the generated password be logged or recovered?

It is created in your tab's memory and shown to you; there is no request that carries it, and nothing is stored. You can verify that by generating a password with your browser's network panel open, or with the network disconnected entirely.

For detecting accidental corruption (a truncated download, a bad copy) yes, and it is fast. For anything where someone might deliberately construct a colliding file, no: MD5 and SHA-1 are both broken in that sense, and SHA-256 is the correct default.

5 tools · runs in your browser

Security

Passwords, hashes and checksums generated and computed on your own machine.

Most used

Password GeneratorGenerate cryptographically strong passwords with custom charset and entropy meter
Passphrase GeneratorGenerate memorable multi-word passphrases from a list of 250 common words
Password Strength CheckerAnalyse password strength, entropy bits and estimated crack time
File ChecksumVerify a download by computing and comparing its SHA-256 and SHA-1 checksums
Random String GeneratorGenerate random strings with custom length, charset and output count

Files never leave your device
No sign-up
Free, no watermarks

All Security tools

Grouped by what you want to get done. Star a tool to find it again on the homepage.

Passwords and secrets · Generate strong passwords and passphrases, and test them.

Password Generator

Generate cryptographically strong passwords with custom charset and entropy meter

Passphrase Generator

Generate memorable multi-word passphrases from a list of 250 common words

Password Strength Checker

Analyse password strength, entropy bits and estimated crack time

Random String Generator

Generate random strings with custom length, charset and output count

Verify files · Check that a download matches its published checksum.

File Checksum

Verify a download by computing and comparing its SHA-256 and SHA-1 checksums

Often used alongside these, from other categories.

About these Security tools

A security tool that runs on somebody else's server has a problem no feature list can fix: the server sees the secret. A generated password that was transmitted is a password that existed somewhere else first. Everything in this category uses the browser's own Web Crypto implementation, which means the randomness comes from your operating system and the result never leaves the tab.

Choosing between these Security tools

Length beats complexity

Adding a character to a password multiplies the search space; swapping an "a" for an "@" barely changes it, and the substitution is in every cracking dictionary. A long passphrase of ordinary words is both stronger and easier to type than a short string of symbols.

Hashing, encoding and encryption answer different questions

A hash is one-way and proves a file has not changed. Encoding is reversible and provides no protection. Encryption is reversible with a key and provides confidentiality. Reaching for the wrong one is a design bug, not a configuration detail.

Checksums verify integrity, signatures verify origin

Comparing a download's SHA-256 against the published value proves the bytes arrived intact. It proves nothing about who published them if the same compromised page supplied both file and hash. A cryptographic signature is what answers the second question.

Questions people ask

Is a password generated in a browser actually random?: Yes, when it uses the Web Crypto API, which is what these tools use. It draws from the operating system's cryptographically secure random source, the same one used for TLS keys, rather than from Math.random, which is predictable and unsuitable for anything secret.
Could the generated password be logged or recovered?: It is created in your tab's memory and shown to you; there is no request that carries it, and nothing is stored. You can verify that by generating a password with your browser's network panel open, or with the network disconnected entirely.
Is MD5 still usable?: For detecting accidental corruption (a truncated download, a bad copy) yes, and it is fast. For anything where someone might deliberately construct a colliding file, no: MD5 and SHA-1 are both broken in that sense, and SHA-256 is the correct default.

Guides on this topic

Generating a random string that is actually randomTwo generators produce strings that look equally random. One of them lets an attacker predict every future value after seeing a few.What actually makes a password strong (it is not the special characters)P@ssw0rd! satisfies every complexity rule ever written and is one of the first things any cracking tool tries. Here is what the maths actually says.Hashing, encryption and encoding are three different thingsIf a system can email you your existing password, it is not hashing them. That single observation tells you a lot about how a service is built.Signing a PDF: what a signature image proves, and what it does notMost documents people call "signed" contain a JPEG of a name. That is often fine, and it is worth knowing exactly what it is, because it proves almost nothing on its own.