# I built a password generator that runs entirely in your browser > Every password generator I found online either wanted my email or ran the "generation" on their server. I built one that does neither. Random, easy-to-read, pronounceable, or diceware passphrase. Everything happens in your browser. Author: Nimoy Burrowes (https://nimoyburrowes.com/about) Category: Tools Published: 2026-07-19T05:00:00.000Z Updated: 2026-07-22T02:14:47.990Z Canonical: https://nimoyburrowes.com/blog/password-generator-that-runs-in-your-browser --- I needed a new password generator last week. The top three Google results all wanted my email, ran ads that looked like antivirus scams, or, in one case, POSTed the generated password to their own backend "for logging". None of that is what a password generator is supposed to do. So I built one. It is live at [nimoyburrowes.com/tools/password-generator](https://nimoyburrowes.com/tools/password-generator). Free, no signup, no ads. **What it does** Four modes: - **Random** for maximum entropy per character. Length up to 128, all four character classes optional, exclude ambiguous characters (0, O, 1, l, I) with one toggle.- **Easy to read** for passwords you have to type off a screen. Random alphanumerics grouped in blocks of four with hyphens, ambiguous characters stripped.- **Easy to say** for passwords you have to dictate over a call. Alternating consonants and vowels.- **Passphrase** for the master password to your password manager. Random words from the EFF large diceware list. Plus a strength meter that runs zxcvbn on anything you type, a QR code for scanning a password into another device without typing it and a "generate 20 at once" button so you can pick your favourite. **The one design constraint that shaped everything** **Nothing leaves the browser.** Not to my server, not to Google, not to a third-party API. The generator, the strength meter, the QR encoder, the diceware wordlist. Everything is in the tab. You can verify. Open DevTools → Network before you click Generate. There is no request. That constraint drove a few decisions: ****Randomness comes from `crypto.getRandomValues`****, the Web Crypto API. Same source your browser uses when it negotiates TLS or generates a passkey. Never `Math.random`, which is fast but not cryptographic. ****Rejection sampling instead of modulo****. Naive `bytes[i] % pool.length` biases the output when the pool size does not divide 2^32. The fix is boring but critical: draw a random 32-bit value, throw it away if it falls into the biased tail, redraw. For a 26-character pool the loop runs once 99.99999% of the time. ****Zxcvbn ships lazily****. The strength meter library is 100 KB minified. If someone lands on the page and just wants a random password, they should not pay for a strength engine they never use. It only loads the first time you type into the analyzer. ****The diceware wordlist is a static asset****. 7,772 words, 62 KB, fetched from the same origin as the page the first time you switch to passphrase mode. Cached forever after that. No CDN, no API. **The educational section is deliberate** I could have shipped just the generator. But the two questions I get every time someone asks about passwords are: - "Should I use symbols?"- "Is a passphrase really as strong as a random password?" The answers are "not really, add length instead" and "yes, and it is much easier to type". Both are on the page in full sentences. Both are wrapped in `HowTo` and `FAQPage` structured data so Google (and increasingly, AI answer boxes) can quote them directly. **What I would build next** Not sure. Maybe an in-browser JWT decoder that never sends the token anywhere. Maybe a diff viewer for sensitive text. The `/tools/` route is the pattern I want to follow: small, single-purpose, everything client-side, no signup. If there is a tool you keep wishing existed, [tell me](https://nimoyburrowes.com/contact). I take on a couple of outside builds a year and I always want good tool ideas for the in-between. Meanwhile, the generator is at [nimoyburrowes.com/tools/password-generator](https://nimoyburrowes.com/tools/password-generator). If it saved you from a shady site, buy me a coffee. ## Frequently asked questions ### Does the password generator work offline? Once the page loads once, yes for random and easy-to-read modes. Passphrase mode fetches the wordlist on first use, so generate one online first if you plan to use passphrases offline. ### Why not just use my password manager's built-in generator? You should. This tool exists for the moments you are away from your manager, on someone else's machine, or generating a password inside a document you cannot yet paste into a manager. ### Is the source code open? Not yet, but every generation function is described in this post and the strength meter is Dropbox's open-source zxcvbn. The wordlist is the EFF's public-domain diceware list. If you want the code, ask. ### How is this different from a Twilio-style API? It is not an API. It is a page you open. The tradeoff is that automated tools cannot call it, and the benefit is that nothing you generate ever hits a network. ### What does "entropy" mean in the strength meter? Roughly: how many guesses an attacker needs. Every extra bit doubles the guesses. 40 bits is guessable in a day on modern hardware. 60 bits takes years. 80 bits is out of reach for anyone short of a nation-state.