websystemer / Security / Password Generator
Password & Secret Generator
Generate strong random passwords and API secrets with your browser's secure random source. Shows entropy. Nothing is sent or stored.
About Password Generatorhow it works and good to know
How the passwords are made
Each character is picked independently and uniformly from the alphabet you choose, using your browser's crypto.getRandomValues. Picks that would favour some characters (modulo bias) are thrown away and redrawn, so every character is equally likely. Every class you select appears at least once.
How long should it be?
The entropy line shows the strength in bits. For a password a manager will remember, 16 characters of letters and digits (about 95 bits) is plenty. For an API key or signing secret, use 32 random bytes as hex or base64url (256 bits).
Look-alike characters
Turn on "No look-alikes" when a person has to read or type the result: it drops I l 1 O 0 o and a few quote-like symbols.
Privacy
Secrets are created on your device. Nothing is sent anywhere, stored or logged, and the page makes no requests after it loads.
Related tools
- Hash & HMACMD5, SHA-1, SHA-256, SHA-384, SHA-512 and HMAC for text and files.
- UUID & ULIDGenerate UUID v4, v7 and ULID, and read the time inside any ID.
- Base64Encode and decode text, with URL-safe and UTF-8 support.
- JWT DecoderRead the header, payload and expiry of a JSON Web Token.
- JSON FormatterFormat, validate, minify and sort JSON.
- URL EncoderPercent-encode, decode and take apart URLs and query strings.