Utiltown

Password Generator

Create strong, cryptographically secure random passwords, memorable passphrases, PINs, and developer-ready hex or Base64 secrets — all generated locally in your browser with the Web Crypto API. Tune the size and character sets, watch the live entropy and estimated cracking time, then copy or download. Nothing is ever uploaded.

All computations run locally in your browser, no data uploaded to server.

Position counts random characters only (0 = right after the prefix, so it behaves like a prefix too).

  
 
 
 —  
  
 
 
 
 
Session history
 
 

Generated values appear here while this tab stays open. They are kept only in
          memory and cleared when you close the page.

  
 
  
 
How To Use
 
     
  1. Pick a type — Password, Passphrase, PIN, Hex, or Base64 — or choose a template preset (Website, Wi-Fi, PIN, passphrase, and so on) to set it automatically.
    2.  
  2. Adjust the size control (it relabels to Length, Words, Digits, or Bytes depending on the type) and any per-type options. Results update live as you drag.
    3.  
  3. Set how many results you want with Quantity (5 by default). Click Generate to create a fresh batch, or Shuffle to roll a new value with the exact same settings.
    4.  
  4. In Password mode you can embed fixed text: a prefix, a suffix, or a middle insert placed after a chosen number of random characters (e.g. “RhTool” after the 3rd character). Enable URL-safe symbols to avoid ? # & = % +.
    5.  
  5. In Passphrase mode, type any separator you like — a space, a hyphen, “+”, or even leave it blank.
    6.  
  6. Click Copy to put the result on your clipboard, Show to reveal it, or Download .txt to save it as a file.
    7.  
 
 
 
Usage Example
 
A 16-character password using all four character sets:
 
9#kD2$mR7vLq!xT4z
 
The same idea with a fixed acme- prefix — 18 characters total, 12 random:
 
acme-9kD2$mR7vLq!xT
 
And a 5-word passphrase with hyphens and a digit:
 
Thunder-coyote4-align-bramble-raven
 

Both are generated randomly, but they suit different situations: the
        dense password is great for a password manager, while the passphrase is
        easier to type and remember for something you may enter by hand.

 
 
 
Use Cases
 

Use this generator whenever you need a fresh secret and you want it
        strong by construction rather than by guesswork. Create unique passwords
        for every online account so one leaked login never breaks the others,
        set a long random key for your Wi-Fi network, or craft a memorable
        passphrase for your master password. Developers can pull a Hex or
        Base64 secret directly for test credentials, API tokens, or a shared
        config value, and use the prefix/suffix fields to stamp a fixed tag
        into a value. Because everything runs in your browser, the generated
        secret never crosses the network, making it safe to use even on
        sensitive systems.

 
 
 
Frequently Asked Questions
  
Is this password generator safe to use?
 
Yes. Passwords are generated entirely in your browser with the Web Crypto API (crypto.getRandomValues) — never sent to a server and never stored. There is no backend, no account, and nothing is uploaded.
  
How long should a password be?
 
Security guidance (NIST SP 800-63-4) recommends at least 15 characters for a single-factor password, or at least 8 characters when used only as part of multi-factor authentication. This tool lets you generate up to 128 characters and defaults to 16, so long random passwords are one click away.
  
What do upper / lower / numbers / symbols mean, and how much difference do they make?
 
Each enabled set expands the pool of characters the generator draws from, which directly raises a random password’s entropy (the number of guesses needed to crack it). As a rough guide, a 16-character password using all four sets has roughly 100+ bits of entropy. If you only enable lowercase, its entropy is the same length times log2(26), which is much lower.
  
What does “Include one of each selected type” do?
 
When enabled, the generator guarantees the random part of the password contains at least one character from every character type you ticked — Uppercase, Lowercase, Numbers, and Symbols. So with all four ticked, the result always has at least one of each (useful when a site requires a mix). If you turn it off, characters are drawn fully at random, so a type might occasionally be missing; that is still secure (length and alphabet are what matter), just less likely to pass sites with strict rules.
  
What is “entropy” and why should I care?
 
Entropy measures uncertainty in bits. For a truly random password it is length × log2(alphabet size). Higher entropy means an attacker must attempt exponentially more guesses. This tool shows a live bit count plus an estimated offline cracking time, so you can see how a length or character choice changes strength. Note that fixed custom characters you embed (a prefix or suffix) are known, so they do not add entropy — only the random portion counts.
  
What is a passphrase and when should I use one?
 
A passphrase is several random words joined by a separator, like “thunder-coyote-align-bramble-raven”. Passphrases are easier to remember and type while still offering strong entropy — each word from a dictionary adds log2(word count) bits. Choose passphrase mode when you may need to type or remember the secret (e.g. a master password).
  
Can I embed my own text into the generated password?
 
Yes. In Password mode you can set a fixed Prefix (start), a fixed Suffix (end), and a Middle insert with a position (for example: put “RhTool” after the 3rd random character). These fixed characters are included in the total length, so the generator shortens the random middle accordingly. Because they are known, they do not add entropy — the strength comes from the random portion.
  
What are “URL-safe symbols” and when should I enable them?
 
Symbols like ? # & = % + are special in URLs, query strings, and many shell commands, so a password containing them may need escaping. Enabling “URL-safe symbols” drops those characters from the pool so the result can be pasted into a URL or a command line with fewer headaches. It slightly reduces the alphabet, so entropy is a touch lower — the readout updates to show the difference.
  
Should I avoid ambiguous characters like “1”, “l” and “O”?
 
Sometimes. Characters that look alike (for example 1 / l / I and 0 / O) are the usual suspects when someone has to type a password by hand. “Avoid ambiguous characters” removes them — handy for Wi-Fi or QR-style sharing — at a small cost in entropy, so it is an opt-in toggle here rather than forced.
  
Why generate a random password instead of choosing one myself?
 
Human-chosen passwords are predictable: they follow dictionaries, names, and keyboard patterns, which cracking tools exploit. A random password drawn uniformly from a large alphabet has no such patterns, so its strength equals its measured entropy — no tricks, no shortcuts.
  
Does the generator keep my password history?
 
No. The on-page history is only held in memory for the current browser session, so you can recover a value you just generated. It is never written to disk, never uploaded, and disappears when you close the tab.
  
 
Related Tools