Password Generator

How to use it

1. Choose a password for something a password manager or a config file will keep, a passphrase for something you have to type or remember, or a token for an API key or an app secret.
2. Set the length, the number of words or the size, and the characters or format to use.
3. Copy the result. Press Generate again for a new one, or ask for 5 or 10 at once.

Results come from your browser’s cryptographic random generator (crypto.getRandomValues), without the bias that a plain % would add. Nothing is sent or stored, and the page address only holds your options, so sharing the link never shares a password.

What the options are for

• Shell-safe symbols only uses _ and .. The result then needs no quoting in a shell or a .env file, and no encoding in a connection URL. It’s the option to use for database passwords and app configs.
• All symbols uses !@#$%^&*()-_=+[]{};:,.?/~. Quotes, backslashes, backticks, |, < and > are always left out, because they break commands and config files. In a shell, still wrap the result in single quotes. In a URL, encode it with the URL encoder.
• No look-alikes drops I l 1 O 0 o, for anything read from a screen or paper and typed by hand.

Tokens: hex, Base64 and Base64URL

A token is random bytes written as text, for API keys, session secrets and signing keys. All three formats hold the same randomness, so choose the one the place you’ll paste it into accepts:

32 bytes (256 bits) is a good default. For example, an HS256 JWT secret should have at least that many, and a shorter one can be guessed offline from a single token.

What the strength figure means

It counts the bits of randomness these options really produce, which is exact for a result from this page. It says nothing about a password you make up yourself: Password123! has all the character types and falls in seconds.

The speed is an assumption, for a fast hash attacked offline. Slow hashes such as bcrypt or Argon2 take far longer, and a login form that limits attempts takes longer still.

Command-line equivalents

openssl rand -base64 24                       # 192 random bits
openssl rand -hex 32                          # a 32-byte hex token
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 24; echo   # letters and digits only
pwgen -s 24 1                                 # from the pwgen package

$b = New-Object byte[] 24; [Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($b); [Convert]::ToBase64String($b)

FAQ

Is it safe to generate a password on a website?

Here, the result is created on your device and never leaves it: open your browser’s Network tab and press Generate again to check that it isn’t in any request. Browser extensions that can read pages can still read this one, and a copied password stays in your clipboard. For the most sensitive secrets, such as a production root password, use your password manager’s generator or openssl on a machine you trust.

Password or passphrase?

Both are strong when they’re random. A six-word passphrase has about 77 bits and is much easier to type, which suits a disk encryption key or a password manager’s master password. Everything else belongs in a password manager, where a long password costs you nothing.

Is this the same as the Base64 tool?

No. The Base64 tool converts text you give it, and anyone can reverse that. Here, the bytes are new and random, and Base64 is just how they’re written down.

Where do the words come from?

From the EFF Long Wordlist by the Electronic Frontier Foundation, under CC BY 3.0 US, without its 4 hyphenated words: 7,772 words, so each one adds about 12.9 bits. The list is public, and that’s fine: the strength comes from the random choice, not from keeping the list secret.

Why don’t capitals add strength to a passphrase?

Because every word gets one, so there’s nothing left to guess. The added digit does count: it adds its value and which word it’s on.

Where should I put the password?

In a password manager, or in your system’s secret store. In a project, keep it in a .env file that git ignores (the .gitignore Generator adds it), not in the code. The Docker Compose Generator already creates one for its services.

I changed the password and now login fails

Check that the application and the database agree. See “password authentication failed” for PostgreSQL, MySQL error 1045, SQL Server error 18456, or Redis NOAUTH.

I changed a signing secret and now tokens fail

Every service has to get the new value, and tokens signed with the old one stop working. See JWT “invalid signature”.