Client-Side vs Server-Side Password Generators
By YPass Team — Updated April 2025
Quick Answer: Client-side password generators (like YPass) run entirely in your browser — your password never touches a server. Server-side generators create passwords on remote servers, introducing risks of interception, logging, and data breaches. For maximum privacy and security, always choose client-side generation using the Web Crypto API.
How Password Generators Work: Two Architectures
All web-based password generators fall into one of two categories based on where the actual generation happens:
Client-Side Generation
Everything happens in your browser. No network requests. Zero server involvement.
Server-Side Generation
Password travels over the network. Server has access to the generated password.
Security Comparison
| Risk Factor | Client-Side | Server-Side |
|---|---|---|
| Network interception | Impossible | Possible (MITM) |
| Server-side logging | N/A | Risk exists |
| Database breach exposure | N/A | Risk exists |
| Third-party data sharing | None | Possible |
| Works offline | Yes | No |
| Verifiable source code | Yes (View Source) | No |
| Randomness quality | CSPRNG (OS) | CSPRNG (server) |
The Web Crypto API: Under the Hood
Client-side generators like YPass rely on the Web Crypto API, a W3C standard available in all modern browsers. The key function is:
// Generate 32 cryptographically secure random bytes
const array = new Uint32Array(32);
crypto.getRandomValues(array);This function:
- Draws entropy from the operating system's random number pool (/dev/urandom on Linux, CryptGenRandom on Windows)
- Produces output that is computationally indistinguishable from true randomness
- Is not predictable even if previous outputs are known (unlike Math.random())
- Is supported in all modern browsers (Chrome, Firefox, Safari, Edge)
Why Math.random() Is Insecure for Passwords
Some web-based generators still use Math.random() — a PRNG (Pseudorandom Number Generator) that is:
- Predictable: With enough outputs, the internal state can be reconstructed
- Low entropy seed: Typically seeded with a timestamp or simple counter
- Not cryptographic: Designed for statistics/simulation, not security
Research by security teams has demonstrated that Math.random() in V8 (Chrome's engine) uses the xorshift128+ algorithm, which can be reversed from just a few outputs.
How to Verify a Generator Is Client-Side
Before trusting any online password generator, verify it runs client-side:
- Open DevTools Network tab (F12 → Network) and generate a password. If you see API calls, it's server-side
- Disconnect from the internet and try generating. Client-side generators still work
- View source code — look for
crypto.getRandomValues()vs. fetch/XMLHttpRequest calls - Check for analytics scripts — Google Analytics, tracking pixels, etc. indicate data collection
Why YPass Chose Client-Side Architecture
YPass was designed from the ground up as a 100% client-side application because:
- Zero attack surface: No server means no server-side vulnerabilities
- Verifiable privacy: View source to confirm no data exfiltration
- No cookies or analytics: Zero tracking of any kind
- Offline capable: Works without internet after initial page load
- CSPRNG via Web Crypto API: Same security standard as enterprise tools
- Fisher-Yates shuffle: Ensures uniform character distribution
Frequently Asked Questions
What is a client-side password generator?
A client-side generator runs entirely in your browser using JavaScript and the Web Crypto API. No data is sent to any server — your password is created locally and never leaves your device.
Is client-side generation secure?
Yes. The Web Crypto API provides CSPRNG from the OS entropy pool — the same quality of randomness used by enterprise tools. Client-side generation also eliminates network interception and server breach risks.
Why is client-side better for password generation?
It eliminates multiple attack vectors: no network interception, no server logging, no database breaches, and no dependency on the provider's security practices. Your password exists only in browser memory.