I've been chatting with my coworkers about the best methods for generating random passwords for low-privilege user accounts, especially since we aren't ready to go fully password-less yet. We discussed the advantages of using various password management tools, particularly those that are web-based and don't require a license, provided they are from reputable sources. However, there was a suggestion to stick with offline tools for better security. Here are my main questions: 1) Does the vendor's reputation really matter when using a web tool for password generation? 2) If the site generating the password doesn't know the context of its use—or the username—why is it a security risk? Is it significantly more secure to opt for an offline password generator?
5 Answers
If you’re looking for simplicity, I’ve got a quick PowerShell command I use to generate random passwords directly from my terminal. It's fast, doesn't mess with the web, and you can tailor it to your needs without worry about an external service.
For many users, an online password generator is fine, especially for temporary accounts or setups without sensitive details. But the safest bet is always to use a password manager with a built-in generator. This way, you manage both generation and storage in one place. Just make sure to prompt users to change their temporary passwords on first login.
Honestly, I think your concerns about using a web-based password generator are a bit overblown. If you're just telling the site what kind of password you need (like length and character set) without giving away any account details, the risk is minimal. You're not revealing sensitive information that would usually attract unwanted attention.
Using tools like Keepass or a simple local script for password generation can definitely enhance security. If you're generating passwords offline, you don't have to worry about potential network-related risks. Plus, you get full control over the complexity and characteristics of the passwords, which can be a lifesaver for legacy systems.
The web can be a risky place for generating and storing passwords. It’s true that some tools might store generated passwords. If I were in your shoes, I’d stick to well-known offline solutions or even local scripts that ensure your passwords remain secure and aren't part of any online database.

Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures