Password generator
Random passwords from a CSPRNG, with the character classes you pick.
Runs entirely in your browser. Nothing you enter here is sent to the server.
Where the randomness comes from, and how long is long enough
Characters come from crypto.getRandomValues, the browser's
cryptographically secure generator, seeded by the operating system. The old version
of this tool used PHP's rand() on the server — predictable, and it
sent you the result over the network. This one never leaves the page.
Picking from the alphabet uses rejection sampling: a random 32-bit number that falls outside a whole number of alphabet-lengths is thrown away instead of being folded in with a remainder. Folding it in is the classic modulo bias, which quietly makes the first few characters of the alphabet more likely.
Reading the entropy figure
Entropy is how many guesses an attacker needs, as a power of two. It depends only on the length and the alphabet — not on whether the result "looks random".
- Under 50 bits — crackable by someone who wants to.
- 70–80 bits — fine for an ordinary account behind rate limiting.
- 100+ bits — for things that must not fall: disk encryption, password-manager master keys, signing keys. The default here is above this.
"At least one of each kind" is here because so many sites demand it. It very slightly reduces entropy, since it rules out some otherwise valid passwords. The effect is tiny; the comfort of the form accepting it is not.
Lookalike removal is for passwords you will read off a screen and type on another device. Skip it otherwise.
Generated passwords are only in this page. Copy what you need before you close or reload — nothing is saved anywhere.
Other tools
- Code scanner — Read QR codes and barcodes with your camera or from an image. Every format ZXing knows.
- Code generator — Make a QR code, Data Matrix, Aztec, PDF417 or a linear barcode and download it.
- Link inspector — See where a link really goes before you open or shorten it: the real host, lookalike letters, hidden redirects and tracking parameters.
- Base converter — Encode and decode between text and Base2 through Base85, or convert integers between any two bases.
- Hash generator — MD5, SHA family, CRC32 and MySQL5 over text or a file. The file is read in your browser.
- JWT decoder — Read a JSON Web Token's header and claims, with every timestamp as a date. Decoded right here; the token is never sent or stored.
- SSH key fingerprint — SHA256 and MD5 fingerprints, key type and size, and SSHFP records for a public key. Private keys are refused unread.
- TOTP generator — Turn a TOTP secret or otpauth:// link into the current code. The secret stays on your device.
- Timestamp converter — Unix time to a calendar date and back, in every format at once. Live clock included.
- Subnet calculator — IPv4 and IPv6: network, range, host count, masks and reverse-DNS pointers.
- Image resizer — Resize and convert an image without it ever leaving your browser. Re-encoding drops EXIF and GPS.
- IP info — Your public IPv4 and IPv6, as this server sees them.
- PHP obfuscator — Wrap PHP so it self-decodes at runtime. Runs on the server; the code is never stored.