You need a strong password for a new account. Google "password generator" and you'll get dozens of options — browser extensions, websites, built-in OS tools, and password manager generators.
The security difference comes down to one question: where is the password created, and does anyone else ever see it?
What We Compared
- Where generation happens — server, browser, or OS
- Randomness source — cryptographically secure or not
- Customization — length, character types, passphrases
- Storage — does the tool save your password?
- Privacy — is the generated password transmitted?
The Comparison
| Tool | Generation location | Crypto-secure | Customizable | Saves password? | Privacy |
|------|---------------------|---------------|--------------|-----------------|---------|
| BrowserStay | Browser (Web Crypto API) | Yes | Yes | No | Never transmitted |
| 1Password Generator | Local (app/extension) | Yes | Yes | Optional (vault) | Local only |
| Bitwarden Generator | Local (app/extension) | Yes | Yes | Optional (vault) | Local only |
| LastPass Generator | Server + local | Yes | Yes | Optional (vault) | Varies by version |
| random.org | Server | Yes | Limited | No | Password sent over network |
| Norton Password Generator | Server | Yes | Yes | No | Generated on server |
| macOS/Windows built-in | OS (local) | Yes | Limited | Via keychain | Local only |
*Based on publicly available information as of 2026.*
Server-Based Generators
random.org, Norton, and various "password generator" websites create passwords on their servers and display them to you.
Strengths:
- No install required
- Work in any browser
- Often offer passphrase modes
Weaknesses:
- The password traveled over the network — even if HTTPS encrypted, the server generated it and could log it
- No way to verify the server isn't storing generated passwords
- Trust-based security — you're hoping they don't log, store, or leak
Best for: Quick throwaway passwords for non-important accounts — if you accept the risk.
Browser-Based: BrowserStay
Generates passwords using the Web Crypto API (crypto.getRandomValues) entirely in your browser.
Strengths:
- Password created locally, never sent anywhere
- Cryptographically secure randomness
- Customizable length and character types
- Client-side — generation happens in your browser via the Web Crypto API
- No account, no storage
Weaknesses:
- Doesn't save passwords (you need a password manager for that)
- No passphrase/word mode (yet)
- Must copy manually
Best for: Generating passwords when you want zero server involvement.
Password Manager Generators
1Password, Bitwarden, LastPass include built-in generators that create and optionally save passwords in your vault.
Strengths:
- Generate and store in one step
- Sync across devices
- Passphrase modes, custom rules
- Local generation in modern versions
Weaknesses:
- Requires account and subscription (most)
- LastPass had notable security incidents — trust matters
- Overkill if you just need one password quickly
Best for: Daily password management — generate, save, and autofill.
Built-In OS Tools
macOS (via Keychain suggestions) and Windows (via Edge/suggested passwords) generate locally.
Strengths: Integrated, local, no extra install
Weaknesses: Limited customization, tied to specific browsers/OS
Best for: Casual users already in the Apple or Microsoft ecosystem.
What Actually Makes a Password Strong
Regardless of which tool you use:
- Length matters most — 16+ characters
- True randomness — from a CSPRNG, not your brain
- Unique per account — never reuse
- Store in a password manager — you can't remember 50 random passwords
The generator is only step one. Storage and uniqueness matter more than which generator you picked.
How to Choose
| Situation | Best choice |
|-----------|-------------|
| Quick password, zero server trust | BrowserStay |
| Generate + save for daily use | Bitwarden or 1Password |
| Throwaway account, don't care | Any generator works |
| Verify no data leaves the page | BrowserStay (client-side) |
| Passphrase ("correct horse battery staple") | 1Password or Bitwarden |
Try It Yourself
Generate cryptographically secure passwords with our Password Generator — Web Crypto API, fully local, nothing stored or sent. Read our guide on what makes a strong password.
No comments yet