Password & Token Generator
Generate cryptographically random passwords (character classes), passphrases (word list), and API tokens (hex / base62 / base64 / base64url / custom), from the browser's crypto.getRandomValues. Each result shows an entropy estimate; the Strength & policy tab breaks down the first one. Copy and download mask the value in shared links. Nothing is uploaded or stored.
Auto-generates as you change options. Click Regenerate for a fresh set.
How to use the Password & Token Generator
Generate strong, cryptographically random passwords, API keys, session secrets, and one-time tokens. Choose length, mix uppercase, lowercase, digits, and symbols, exclude lookalike characters, and generate several at once. Randomness comes from the browser's crypto.getRandomValues — the same primitive used by password managers and TLS implementations. Nothing is uploaded or stored.
What it does
- Generates cryptographically random passwords using
crypto.getRandomValues. - Configurable length (typically 16–64 characters for tokens).
- Toggle character sets: uppercase, lowercase, digits, symbols, custom sets.
- Exclude look-alike characters (
0/O,1/l/I) for readability when dictating or typing. - Generate multiple passwords at once for bulk needs.
- Shows an entropy estimate in bits so you can gauge strength.
When to use it
- Set up a new service account password.
- Generate an API key, JWT signing secret, or webhook secret.
- Create a one-time recovery code or invite token.
- Provision an initial DB / Redis / queue password during environment setup.
- Create CI / deploy secrets that are not committed to source.
- Need a quick passphrase for an encrypted file or PFX bundle.
How to use it
- Set the length (16+ for general use, 32+ for secrets and tokens).
- Toggle character sets — including symbols unless your target system rejects them.
- Optionally exclude look-alike characters for human-typed passwords.
- Click Generate; copy the result to clipboard or generate several at once.
- Store the new credential in a real password manager — do not paste into chat or email.
Tips & pitfalls
- Length beats complexity. A 24-char alphanumeric password is far stronger than an 8-char mixed-symbol one.
- Some systems silently truncate long passwords — verify by re-logging in after a reset.
- Symbols can break legacy URL or shell contexts — escape or remove them when needed.
- Never share secrets via chat or email. Use a vault (1Password, Bitwarden, HashiCorp Vault, AWS Secrets Manager).
- Treat generated secrets as one-time — rotate immediately if shown to anyone, even in a screenshot.
- Browser tab history does not remember the value — it is generated in memory only.
FAQ
- How random is the output? Cryptographically random — the browser's
crypto.getRandomValuesuses the operating system's CSPRNG. - How long should my password be? 16+ for general use, 24+ for sensitive accounts, 32+ for machine-to-machine tokens. Pair with 2FA where possible.
- Are generated passwords stored? No. They are produced in memory in your browser and never sent to a server.
- Why are symbols sometimes a bad idea? Some systems reject specific symbols, and shell or URL contexts may treat them specially. Disable symbols if your target rejects them.
- What is entropy? A measure of how unpredictable a password is, in bits. 128 bits is considered very strong; 60–80 bits is typical for daily-use passwords.
- Can I generate API keys with this? Yes — pick length 32–64, alphanumeric only, and copy the result into your secret store.
Runs locally in your browser using crypto.getRandomValues. No uploads. Generated secrets are not stored.