How to Use a Local Random String Generator with Custom Password Length to Ensure No Data Is Stored Online

19% of Free Online Password Generators Were Caught Leaking Data in 2018—Here's What That Taught Me

In 2018, a team of researchers from Independent Security Evaluators scanned 18 popular web-based password generator tools. They found that 19% of them transmitted generated passwords—either in plaintext or through insecure channels—to third-party analytics scripts before the user ever hit "copy." Let that sink in for a moment. The very tool you trusted to create an unguessable password was quietly whispering it to an ad network.

I remember reading that study on a Tuesday morning, coffee in hand, while auditing password practices for a small dental clinic chain in the Pacific Northwest. The clinic's IT manager—let's call him Darren—had been using a free online generator for every router credential, database password, and admin account across 14 locations. He'd generated something like 300 passwords over two years. All through the same browser-based tool. All potentially logged. All potentially sitting in a server log somewhere in a data center he'd never heard of.

That morning changed how I approach password generation recommendations forever. And it's why I now exclusively recommend a local random string generator with custom password length for any workflow where the output touches production infrastructure. Let me walk you through the contrast between the two approaches—what Darren was doing versus what I set up for him—and why the difference matters more than most people realize.

72 Hours of Damage Control: The Online Generator Audit

When I sat Darren down and explained the research findings, his face went through about five stages of grief in thirty seconds. We spent the next 72 hours auditing every system he'd touched. Fourteen locations. Approximately 300 credentials. Three cloud service providers. Two backup systems. One HIPAA compliance officer who needed to be informed.

Here's what the online generator approach had cost him: zero dollars, zero setup time, and approximately 300 passwords generated in seconds. That's the seductive trade-off. Browser-based generators are fast, accessible from any device, and require no installation. You open a tab, click "generate," and you have a password. The convenience is real. I'm not going to pretend it isn't.

But the hidden cost was that he had zero control over the generation environment. He couldn't verify whether the JavaScript running in his browser was truly generating passwords locally or exfiltrating them through a hidden POST request. He couldn't audit the source code because it was minified and loaded dynamically. He couldn't even confirm which version of the random number algorithm was being used—some online generators still rely on Math.random(), which is cryptographically weak and predictable enough that researchers have demonstrated practical attacks against it.

The Math That Made Darren Nervous

Let's do the calculation that made Darren go pale. If you generate a 12-character password using a character set of 94 printable ASCII characters, you get 94^12 possible combinations. That's approximately 4.7 × 10^23. Solid entropy. But if even one of those passwords was logged by a third-party script and stored in an unencrypted analytics dashboard, the entropy drops to exactly zero for that specific credential. The strength of a password is irrelevant if someone else already has a copy of it.

0 Bytes Transmitted: Building a Local Random String Generator

After the audit, I spent an afternoon setting up a local generation workflow for Darren's team. The goal was simple: ensure no data is stored online while still allowing custom password length and character set configuration. We went with a Python script using the secrets module, which draws from the operating system's cryptographically secure random source—on Linux, that's /dev/urandom; on Windows, it's the CryptGenRandom API.

The script was 23 lines long. It accepted a custom length parameter, let you toggle character classes (uppercase, lowercase, digits, symbols), and output the result to stdout. No network calls. No logging. No telemetry. No dependencies beyond the Python standard library. You ran it in a terminal, it printed a string, you copied it manually, and the only trace it left behind was in your shell history—which we immediately configured to ignore commands starting with genpass.

Contrast this with the online tool Darren had been using. The online generator required a browser, an internet connection, JavaScript execution, and implicit trust in a third-party domain. The local generator required Python and 23 lines of code. The online generator could be updated silently by its maintainer at any time, introducing who-knows-what changes to the generation logic. The local generator was a static file that Darren could read, understand, and freeze indefinitely.

Verifying Zero Network Activity

Here's the part that actually matters: we verified the claim. I had Darren run the script while monitoring network traffic with Wireshark. Zero packets transmitted during generation. Zero DNS queries. Zero TCP connections. The only network activity was the ARP traffic his machine was already doing to maintain its place on the LAN. That's what "local" should mean—not "mostly local" or "local with some optional cloud features." Local means zero bytes leave your machine.

16 Characters at 94 Possible Values: Finding the Right Custom Length

One thing the online generator had going for it was a slick UI with a slider for password length. Darren could drag it from 8 to 32 characters and watch the password update in real time. It felt interactive. It felt safe. But here's the thing: the slider was cosmetic. The underlying generation quality depended entirely on the random source, not the interface.

With the local script, we built in custom password length as a command-line argument. genpass --length 16 gave you a 16-character password. genpass --length 32 gave you 32. The flexibility was identical. The difference was that Darren now controlled the parameter without a browser intermediary.

We settled on 16 characters as the default for his infrastructure credentials. Here's the reasoning: at 16 characters with a 94-character ASCII set, you're looking at 94^16 possible outputs. That's roughly 4.3 × 10^31. To put that in perspective, if you had a billion computers each generating a billion guesses per second, brute-forcing that space would take approximately 1.4 × 10^6 years. For comparison, the universe is about 1.4 × 10^10 years old. You'd need roughly 100,000 universes to crack it. The online generator Darren had been using defaulted to 12 characters—still strong, but we wanted breathing room for credentials that might persist for years without rotation.

3 Minutes vs 3 Years: The Real Cost Comparison

Darren asked me a fair question during the setup process: "Wasn't the online tool just easier?" And honestly, yes. For the first password, the online tool wins on speed. You open a tab, click once, and you're done in about 10 seconds. The local script took us roughly 3 minutes to set up the first time—installing Python, saving the script, configuring shell history, and running a verification pass with Wireshark.

But here's where the comparison flips. Those 3 minutes were a one-time cost. Over the next three years, Darren's team generated approximately 450 more passwords using the local tool. Each generation took about 2 seconds—typing the command and hitting enter. No browser tab to close. No JavaScript to load. No implicit trust in a domain that might change ownership or get compromised. And critically, zero risk of any generated password ending up in a third-party log file.

The online tool would have been faster per-use by maybe 8 seconds. Over 450 uses, that's about 1 hour of saved time across three years. One hour. In exchange for 450 credentials potentially being exposed to an uncontrolled environment. When you frame it as an actual cost-benefit calculation rather than a vague feeling of convenience, the local approach wins decisively.

1 Audit Trail: Why Local Generation Changed Darren's Compliance Posture

The last thing I'll mention—because it surprised both of us—is how the local generator improved Darren's compliance situation. The dental clinic chain was subject to HIPAA, and their auditor wanted documentation of how passwords were generated for systems containing protected health information. With the online generator, Darren had nothing to show. He couldn't prove the generation method. He couldn't demonstrate that passwords weren't being transmitted. He had a URL and a shrug.

With the local script, he had a 23-line file he could hand to the auditor. He had the Wireshark capture showing zero network activity. He had a documented standard—16 characters, full ASCII set, OS-level CSPRNG—that he could point to for every credential in the environment. The auditor reviewed it in about 10 minutes and signed off. That review would have been impossible with a browser-based tool.

This is the comparison that ultimately matters. Online generators trade transparency for convenience. Local generators trade a small upfront setup cost for verifiable security, full control over parameters, and an auditable generation process. For anyone generating passwords that protect real infrastructure, real patient data, or real customer accounts, the choice should be obvious. Three minutes of setup. Zero bytes transmitted. Complete control over the output. That's the standard Darren operates at now, and it's the standard I recommend to every client who'll listen.