Password Generator

How to Use This Tool

1. Choose lengthPrefer a long value accepted by the account or application.
2. Select character groupsKeep the groups the destination supports; at least one must remain enabled.
3. Generate and storeRegenerate if needed, copy manually, and save it in an appropriate password manager.

How It Works

A cryptographically secure Uint32 value selects each character. Values outside an even multiple of the pool length are discarded before modulo selection, avoiding modulo bias. One character is selected from every enabled pool, remaining positions use the combined alphabet, and a secure Fisher–Yates shuffle removes predictable group placement.

Worked Examples

What the Strength Label Means

The label is a simple signal based on length and how many pools are enabled. It does not model a specific attacker, breached-password reuse, predictable user edits, phishing, server protections, or rate limits. Random length and uniqueness matter more than meeting a visual label.

How Long Is Long Enough

Length is the only setting here that changes the answer by orders of magnitude, and the arithmetic is short enough to check. With all four groups enabled the alphabet is 88 characters — 26 lowercase, 26 uppercase, 10 digits and 26 symbols — so each position contributes log2(88), about 6.46 bits. Total strength is that figure multiplied by the length, which is why adding four characters helps far more than adding a symbol group to a short password.

The table below is that multiplication, nothing more. It is a measure of how much randomness the generator put into the string, not a cracking-time estimate: how long a real attack takes depends on whether the site stores passwords with bcrypt or with unsalted SHA-1, and that is not a property of your password. For context on the policy side, NIST’s published guidance on memorized secrets asks verifiers to allow at least 64 characters, to stop imposing composition rules, and to stop forcing periodic rotation — advice this tool is built around.

Where the Password Goes Next

A generated value rarely gets used as typed. Dropped into a database or broker connection string, characters such as @, : and / terminate the URL early, so the password has to be percent-encoded for a connection string before it will connect. Config files and HTTP Basic Auth headers want it encoded as Base64 instead, which is an encoding step and not a security one — anyone holding the encoded string can read it straight back.

For a Wi-Fi passphrase, a 20-character random string is painful to read aloud, so it is easier to turn it into a QR code guests can scan. If the credential lands in a JSON settings file, format and validate that JSON afterwards, because a stray quote inside a generated symbol run is an easy way to break a config you cannot then load.

When you rotate a secret across several environment files at once, the risk is not generating the new value but missing one of the places the old one was written. Diffing the old file against the new one shows every line that actually changed, which is faster and more reliable than reading both.

A Secret, an Identifier and a Digest Are Not Interchangeable

These three get reached for interchangeably and they solve different problems. A password is a value chosen to resist guessing, which is what this page produces. A UUID names a record and is designed to be unique, not unguessable — a version 7 UUID even encodes the moment it was created, so using one as a session token or a reset link hands an attacker a starting point.

A SHA-256 digest runs in the other direction: it is derived from content and detects whether that content changed. Hashing a weak password does not make it strong, because the attacker guesses the input and hashes it too. Where a digest genuinely belongs is on the server side, as the stored form of a password, produced by a deliberately slow function such as bcrypt or Argon2 rather than by a fast general-purpose hash.

Signing secrets are the case people most often get wrong. An HS256 token is signed with a shared symmetric secret, so it needs the same high-entropy random value this generator produces, not a memorable phrase somebody typed. Decoding a token shows you its algorithm and claims, and is the quickest way to confirm whether the thing you are protecting is signed with a secret at all or with a key pair, which changes what you need to generate.

Practical Password Hygiene

• Use a different password for every important account
• Prefer longer random passwords when the site allows them
• Store credentials in a reputable password manager
• Enable multi-factor authentication when available