It's a fair question. You type nothing, click a button, and a strong password appears. But where was it actually made — on your computer, or on theirs? The answer decides whether the site can see (and log) your password.
1. Two kinds of generators
Server-side generators create the password on the website's server, then send it to your screen. The password existed on their machine first. A careless or malicious operator could log it. That quietly defeats the purpose of a "secure" password.
Client-side generators do everything in your browser, using JavaScript. The password is assembled on your own device and never leaves it. The website's server is never involved in making it.
2. How to tell which one you're using
- Read the page. Trustworthy tools say "runs locally in your browser" or "client-side". If they say nothing, assume server-side.
- Open DevTools (F12) → Network tab, then click Generate. If no request fires when the password appears, it was made locally.
- Avoid generators that ask you to "sign in" just to make a password — that's a red flag they're processing it centrally.
3. Why Jisubao's generator is private
Jisubao generates passwords with the Web Crypto API (crypto.getRandomValues) — the same primitive browsers use for TLS and secure sessions. The password is produced on your device and never transmitted anywhere. We literally cannot see it, because it never reaches our servers.
👉 Try it: Jisubao Password Generator →
4. Good hygiene still matters
- Use a password manager to keep a unique random password per site.
- Turn on 2FA everywhere it's offered — it beats any single password.
- Never reuse a password, even a strong one.
A local generator removes the "can they see it" risk. A manager and 2FA remove the "what if one site leaks" risk. Use all three.