Skip to content

Your Password Generator

All tools · client-side

Password & Developer Tools

Every tool on the site, grouped by who it is for: passwords and PINs for people, identifiers, hashes and secrets for applications. All of them run in your browser.

Password tools

Passwords, passphrases and PINs for people - and tools to check how strong they are.

Password Generator

Strong random passwords, 8-64 characters, in bulk.

Passphrase Generator

Memorable passphrases from the EFF wordlist.

Random PIN Generator

4 and 6 digit PINs that avoid the most common codes.

Password Strength Checker

Test a password against patterns and common passwords.

Password Entropy Calculator

Entropy in bits and how long a password takes to crack.

Password Requirements

Check a password against a service's published rules, then generate one that fits.

WiFi Password Generator

Wi-Fi passwords and passphrases that every WPA2 and WPA3 router accepts.

Developer tools

Identifiers, random strings, hashes and secrets for applications.

UUID Generator

Random version 4 UUIDs, one or a thousand at a time.

Username Generator

Username ideas with your name or keywords, checked against platform rules.

Random String Generator

Random strings from your own character set, without modulo bias.

Hash Generator

MD5, SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, side by side.

SHA-256 Hash Generator

SHA-256 of text or a file, to check downloads and checksums.

MD5 Hash Generator

MD5 of text or a file, to compare with a published MD5 checksum.

Bcrypt Generator

bcrypt hashes with a chosen cost, and a check of a password against a hash.

Htpasswd Generator

user:hash lines for Apache basic authentication, with bcrypt by default.

TOTP Generator

Time-based one-time codes from a test secret, with a QR code and a code check.

API Key Generator

Random API keys from 16-128 bytes, hex or base64url, with a prefix.

JWT Secret Generator

Strong HMAC secrets for HS256, HS384 and HS512 signing.

Password requirements by service

What each service publishes about passwords, with a live check and a password that fits. All services and NIST's baseline are on the password requirements page.

Apple ID password requirements

Apple Account (Apple ID) requires at least 8 characters, including an uppercase letter, a lowercase letter and a number.

Microsoft account password requirements

Microsoft work or school account (Entra ID) requires 8 to 256 characters, with at least 3 of the 4 character types, only a-z, a-z, 0-9, the listed symbols and spaces (no other unicode characters).

Amazon password requirements

Amazon does not publish password requirements in its help pages.

TikTok password requirements

TikTok does not publish password requirements in its help pages.

Instagram password requirements

Instagram requires at least 6 characters.

Spotify password requirements

Spotify does not publish password requirements in its help pages.

Gmail password requirements

Google Account (Gmail) requires only ascii letters, numbers and symbols (no accents or other characters), does not start or end with a space.

Discord password requirements

Discord requires at least 8 characters.

Password examples by length

Fresh examples at one exact length, with entropy, crack times and the sites that accept that length.

8-character password examples

Fresh 8-character password examples generated in your browser, with entropy (51.3 bits with all types), crack times and which sites accept 8 characters.

12-character password examples

Fresh 12-character password examples generated in your browser, with entropy (78.1 bits with all types), crack times and which sites accept 12 characters.

16-character password examples

Fresh 16-character password examples generated in your browser, with entropy (104.6 bits with all types), crack times and which sites accept 16 characters.

How These Tools Work

Every tool on this page runs inside your browser tab. Random values - passwords, passphrases, PINs, UUIDs, strings, keys and secrets - come from crypto.getRandomValues() or crypto.randomUUID(), the browser's cryptographically secure random number generator. Hashes come from crypto.subtle.digest(). All of these belong to the Web Cryptography API, which the browser implements natively.

No tool makes a network request while you generate, check, hash or copy, and nothing is written to cookies, local storage or the address bar. The passphrase generator loads its wordlist and the strength checker its dictionaries from this domain, once. How it works shows how to check all of this yourself.

Which tool do I need?

A login for a person: the password generator, or the passphrase generator if it must be typed or remembered.
A phone, card or door code: the PIN generator.
Checking a password you already have: the strength checker.
A secret for an application: the API key or JWT secret generator.
An identifier or a checksum: the UUID generator or the SHA-256 hash generator.

Secrets and non-secrets

Passwords, PINs, API keys and JWT secrets are credentials: for those, the copy button clears your clipboard after 30 seconds. A UUID is an identifier and a hash is a fingerprint of data - you can usually share both, so they are copied without the countdown.