How 1Password Generates Passwords (and Why a Local Tool Helps)
The Password Generator builds a random password from the character sets you select, using a cryptographically secure random number generator (CSPRNG) that runs entirely inside your browser, and the output is never transmitted to a server. To use it for 1Password, you open the Password Generator, choose a length of 16 or more, enable uppercase, lowercase, digits, and symbols, optionally exclude ambiguous characters like 0, O, 1, and l, click Generate, and then copy the result into a new or existing 1Password entry. Every character is drawn from the browser's built-in crypto.getRandomValues API, which is designed to be unpredictable, unlike JavaScript's Math.random, whose output can be modeled from prior values. The generator also uses rejection sampling to eliminate modulo bias, guarantees at least one character from each type you select, and shuffles the result with the Fisher–Yates algorithm so the guaranteed characters are not pinned to fixed positions. Strength is reported in bits of entropy, computed as length × log2(poolSize), so you can see at a glance whether the password you are about to copy into 1Password clears a useful threshold.
1Password itself ships with a built-in generator that fires when you create or update a login, so most users never need anything else. The case for a separate local browser tool is about transparency and control: you can see the entropy figure, pick the exact pool size, exclude ambiguous glyphs, and reuse the same routine on any device without logging into the manager first. Both approaches rest on the same cryptographic idea, so the choice comes down to where you want the work to happen.
Generating a Strong Password Step by Step
- Open the Password Generator in your browser tab.
- Drag the length slider, or type into the number box, until the display reads 16 or higher. Length is the single biggest lever on entropy, and 16 characters from the full pool gives roughly 103 bits.
- Tick the boxes for uppercase letters, lowercase letters, digits, and symbols so the pool is 86 distinct characters.
- If you plan to transcribe the password by hand for a recovery sheet, switch on "exclude ambiguous characters" so 0, O, 1, and l are removed. This trades a small amount of entropy for much easier reading.
- Read the entropy number shown beneath the output. Aim for 100 bits or more for any account that holds financial data, email, or admin access.
- Click Generate new password. If the first string does not suit you, click again; each click rolls an entirely fresh random value.
- Click Copy, then move straight to 1Password and paste the value into the password field of a new item or an existing entry you are updating.
- Close or refresh the browser tab once the entry is saved. Because generation is local, closing the tab discards the password from memory and it is never written to a server log.
Understanding Entropy and Length
Entropy, measured in bits, is the most useful single number for comparing passwords because it estimates how many guesses an attacker would have to try, on average, to land on yours. Each character you add multiplies the search space by the pool size, so the formula is straightforward: entropy = length × log2(poolSize). With all four character sets enabled, the pool is 86 characters and log2(86) is about 6.426, so each character contributes roughly 6.4 bits.
Worked example: a 16-character password drawn from the full pool carries 16 × 6.426, which equals about 103 bits of entropy. That figure sits comfortably in the "strong" range against offline brute-force attacks.
| Length | Entropy (bits) | Strength band |
|---|---|---|
| 12 | ~77 | Fair |
| 16 | ~103 | Strong |
| 20 | ~129 | Strong |
| 24 | ~154 | Strong |
As a rule of thumb, anything under 60 bits is weak against a serious attacker, 60 to 100 bits is fair, and 100 bits and above is strong. Length wins every time: doubling the length doubles the entropy, whereas swapping from lowercase-only to mixed case adds only a constant factor of about 1.7 bits per character.
A subtle but real detail is modulo bias. If a generator maps a raw random number onto a character set by taking the remainder when divided by the set size, some characters get picked slightly more often whenever the set size does not evenly divide the random number range. That tiny imbalance shaves real entropy off the output and makes the password more predictable. The Password Generator avoids this by discarding random values that fall into the biased remainder band and redrawing, so every character is chosen with exactly equal probability. It then shuffles the entire result with the Fisher–Yates algorithm so the guaranteed characters from each set are not pinned to fixed positions where an attacker could exploit the pattern.
Comparing the Local Generator to 1Password's Built-In
Both paths produce cryptographically random passwords; the difference is where the work runs and how much of the process is visible to you.
| Aspect | 1Password built-in generator | Local browser Password Generator |
|---|---|---|
| Where generation runs | Inside the 1Password app or browser extension | Inside your browser tab |
| Network usage | None for the generation step itself | None after the page loads |
| Randomness source | App's own CSPRNG | Browser's crypto.getRandomValues |
| Length and character controls | Configurable in app settings | Slider plus checkboxes in the UI |
| Entropy display | Not always surfaced | Shown as bits under the output |
| Account required | Yes, an active 1Password subscription | No account needed |
| Storage of the password | Saved in the vault when you confirm the entry | Exists only in the browser tab until you close it |
If you are already inside 1Password and need a fresh login, the built-in tool is the smoothest path because it writes the password straight into the entry as it generates. The local browser generator is the better choice when you want a password before you sign up for 1Password, when you need to see the entropy figure, when you want to batch a list of credentials, or when you simply prefer to inspect exactly how the string is built. Both rely on the same underlying idea — a CSPRNG plus unbiased character selection — so output quality is comparable.
Saving the Generated Password in Your Vault
Once the Password Generator hands you a string, the workflow inside 1Password is short. Open 1Password and create a new item, or edit an existing login. Tap into the password field, paste the value you copied from the generator, and let 1Password prompt you to confirm the strength — anything above 100 bits will register as strong. Save the entry, then close the browser tab that produced the password so the string is no longer sitting in browser memory.
Two habits make a large difference. First, never reuse a generated password across sites; uniqueness is what stops a breach on one service from cascading into the others you hold in 1Password. Second, do not paste a generated password into a notes app, chat window, or email draft on the way to the vault — paste it directly into the password field so the string never touches plaintext storage outside the manager.
Modern guidance from OWASP's Authentication Cheat Sheet and NIST SP 800-63B favors long, random, unique passwords kept in a manager, exactly the pattern the Password Generator plus 1Password produces. If you want a parallel workflow that does not rely on any extension at all, the guide Generate Strong Passwords Locally in Chrome (No Sync) walks through the same CSPRNG approach using Chrome's built-in tools. Because generation happens locally, your password is never transmitted over the network, written to a server log, or stored anywhere; it exists only in your browser tab until you copy it, and closing the tab discards it.