Open Source Password Generator
A generated password is only as strong as two things: where its randomness comes from and where the generation happens. A polished strength meter means nothing if the entropy is weak or the candidate secret passes through someone else's server on its way to you. This category also blurs a line worth keeping straight - some tools only generate a random string or passphrase, while others derive passwords deterministically from a master secret, which is a genuinely different security model rather than a convenience. Open source is what lets you tell the difference: you can read exactly which random source a tool uses and confirm that a new password only ever exists on the machine that made it.
KeePassXC
Offline, encrypted password manager that stores your vault in a local KDBX file you control
KeePassDX
Lightweight, ad-free Android password manager for KeePass databases with biometric unlock and autofill
LessPass
Stateless password manager that recomputes your passwords from a master password, so there is no vault to sync
Padloc
Modern, end-to-end encrypted open source password manager for individuals and teams
gokey
Vaultless password manager in Go that derives passwords from a master password and realm string
xkcdpass
Flexible, scriptable passphrase generator inspired by XKCD 936
Readable Passphrase Generator
Passphrase generator that creates mostly grammatical but nonsensical phrases that are easy to remember
Pgen
Command-line passphrase generator with EFF wordlists, BIP39, entropy output, and dice mode
pwgen
Self-hosted password generator for passwords and passphrases with clipboard copy and offline mode
Our picks
The right generator depends on where you want the password to be created and kept.
Best command-line passphrase generator: Pgen Pgen builds passphrases from the EFF wordlists or BIP39 and prints the entropy for your chosen settings, so strength is a number you can check rather than trust. It offers a dice mode that uses physical dice instead of computer randomness, runs entirely as a local CLI with no hosted service, and installs through cargo.
Best browser generator: correcthorsebatterystaple correcthorsebatterystaple generates xkcd-style passwords entirely client-side using a cryptographically secure random source, and loads no external scripts or analytics, so nothing about your password leaves the page. It was built specifically to replace insecure generators that rely on Math.random(), and the whole thing is open source and auditable.
Best generator inside a password manager: KeePassXC KeePassXC pairs a built-in password generator with an offline, encrypted KDBX vault, so a new secret is created and stored in one auditable place without ever hitting the clipboard. It runs on Windows, macOS, and Linux, adds a scriptable CLI, and imports from the major proprietary managers if you are moving in.
Best vaultless option: LessPass LessPass stores no vault at all, recomputing each password from your master password, the site, and a login, so the same inputs always regenerate the same credential on any device. It offers browser extensions, a CLI, and mobile apps, with an optional self-hosted server to sync saved site profiles. The trade-off is that the derivation itself must stay reproducible.
What to check before trusting a generator
Randomness is the whole game, so look at the source before the interface. A trustworthy generator draws from the operating system's randomness or a documented cryptographic random number generator, not a homegrown formula seeded by time or mouse movement. correcthorsebatterystaple exists specifically to avoid weak browser generators built on Math.random(), and the wordlist tools make their entropy explicit - Pgen and xkcdpass print the entropy for your chosen settings, so strength is something you can calculate rather than guess. For passphrases, the size of the word list matters as much as the number of words.
Decide where generation is allowed to happen. A command-line tool like Pgen or xkcdpass, or a desktop manager like KeePassXC, keeps candidate secrets on your own machine and works offline, which is what you want for recovery passwords or break-glass credentials. A web tool is only safe if generation runs entirely in your browser, so pwgen and correcthorsebatterystaple, which produce values client-side, are safer than any server that could see the secret first. Clipboard handling matters more than it looks: automatic clearing, no history, and no analytics all reduce accidental disclosure.
Treat deterministic tools as a separate decision. LessPass and gokey store no vault at all, recomputing each password from a master secret and a site name, which removes syncing but means the recipe itself must be reproducible elsewhere if the tool disappears. If you would rather store secrets than recompute them, a full manager like KeePassXC or KeePassDX bundles a generator with an encrypted local vault, so generation and safekeeping live in one auditable place.
Related categories
Frequently asked questions
How can I tell whether a password generator is random enough?+
Look for use of the operating system's randomness source or a cryptographic random number generator, not a formula based on time or a simple pseudo-random library. correcthorsebatterystaple was written specifically to replace generators built on Math.random(). The tool should make length or word count explicit rather than implying that one extra symbol fixes a short password. For passphrases, a large word list matters as much as the number of words drawn.
Is a passphrase better than a random character string?+
It depends on the use. Passphrases are easier to type and read aloud, which suits disk encryption, Wi-Fi, and recovery codes, and tools like xkcdpass, Pgen, and the Readable Passphrase Generator specialize in them. Random character strings are better where a password manager fills the value and the site accepts long inputs. Either way, entropy at a usable length is what counts - four common words are weak, but several drawn uniformly from a large list are strong.
Should I use an online password generator at all?+
Only if generation happens entirely in your browser and you trust how the page reached you. A server-side generator can see the secret before you do, which defeats the purpose for account passwords. pwgen and correcthorsebatterystaple generate client-side, and pwgen can be self-hosted so you control delivery. Avoid any generator that logs history, phones home while generating, or mixes password creation with ads.
What is the difference between a generator and a vaultless tool like LessPass or gokey?+
A plain generator produces a fresh random value and hands it to you. LessPass and gokey are deterministic: they recompute the same password from a master secret plus a site or realm string, so there is no vault to store or sync. That trades one risk for another - nothing to leak, but the recipe must be reproducible elsewhere, and changing a site's password means overriding the derivation. Treat it as a distinct security model.
Do password generators need an internet connection?+
No, and for most uses connectivity is undesirable during generation. A desktop app, mobile app, or CLI tool such as Pgen, xkcdpass, or gokey uses local system randomness with no service involved. Offline operation is exactly what you want when creating recovery passwords or credentials during an outage. pwgen even ships an offline mode that disables its external breach check, so nothing leaves the machine.
Which of these fit into scripts or automation?+
The command-line tools are built for it. Pgen and xkcdpass generate passphrases from the terminal, xkcdpass can also be imported as a Python module, and gokey derives passwords and keys for provisioning without a vault. KeePassXC ships a CLI that can script vault operations. Be careful with shell history, process lists, and CI logs, since most automation leaks happen after generation rather than inside the random number function.
How should a generator work with a password manager?+
The cleanest workflow is generating the password inside the manager itself - KeePassXC, KeePassDX, and Padloc all include a built-in generator, so the secret is created and saved in one step without touching the clipboard. If you generate separately, save the value immediately with the correct site, username, and notes so it is not stranded in the clipboard, and avoid retyping long random strings by hand.