Password Generator

About Password Generator

Password Generator on UtilityKit creates cryptographically strong random passwords entirely in your browser using the Web Crypto API's window.crypto.getRandomValues — the same entropy source used by security software and operating system key generators. Choose a length from 8 to 128 characters, toggle character sets (uppercase, lowercase, digits, symbols), exclude ambiguous characters like 0, O, l, and 1 that are hard to read in certain fonts, and require at least one character from each enabled set to guarantee charset compliance. Generated passwords are never transmitted to any server, never logged, and vanish when you close the tab. The tool is designed for situations where you need a strong, unique password immediately — creating a new account, rotating a shared service credential, generating a Wi-Fi passphrase, or rotating a credential — without exposing the value to a server.

Why use Password Generator

How to use Password Generator

1. Set your desired password length using the slider or number input. Common recommendations: 16+ characters for most accounts, 24+ for admin credentials, 32+ for API keys and service accounts.
2. Toggle the character sets you need: uppercase (A–Z), lowercase (a–z), digits (0–9), and symbols (!@#$%^&* etc.). At minimum, enable two character sets for any production password.
3. Optionally check 'Exclude ambiguous characters' to remove 0, O, l, 1, I from the charset — useful for passwords that will be read aloud or typed manually from a screen.
4. Click Generate. The tool uses window.crypto.getRandomValues to draw from OS-level entropy — not Math.random() — ensuring cryptographic unpredictability.
5. Review the password strength indicator showing estimated entropy bits and crack-time estimate for your selected settings.
6. Click Copy to clipboard, then immediately paste into your target field or password manager. Generate a new password if you need an alternative without adjusting settings.

When to use Password Generator

• When creating a new account on any service and you want a unique, strong password that is not reused from another site.
• When rotating a compromised or weak password for a critical service — database root, cloud admin console, or API key — and you need something strong immediately.
• When generating a Wi-Fi passphrase for a new network and you want something long enough to be secure but can exclude ambiguous characters for easier manual entry on devices.
• When a system requires a password that satisfies specific complexity rules (must include symbol, no ambiguous chars, minimum 16 chars) and you want to match those rules precisely.
• When you need a temporary password to hand to a new team member before they set their own, and you want it strong enough to be safe during the handoff window.
• When testing authentication systems and you need a large batch of valid passwords matching defined complexity rules for load testing or integration test fixtures.

Examples

Tips

• Generate passwords of at least 20 characters for any account you consider critical — the marginal length cost is zero, and longer passwords are exponentially harder to brute-force.
• Enable all four character sets (upper, lower, digits, symbols) by default and only disable symbols when the target site explicitly rejects them — switching to a longer length to compensate.
• After generating, copy immediately and paste into your password manager's notes field before pasting into the target site — reduces the risk of losing the password if the site rejects it for some reason.
• Use the ambiguous-character exclusion only for passwords that will be read aloud or typed manually; for passwords pasted directly from a manager, keep all characters enabled for maximum entropy.
• If you need multiple passwords (e.g. for a batch of test accounts), click Generate repeatedly — each click draws new entropy independently and produces a fully different password.

Frequently Asked Questions

Explore the category

Glossary

CSPRNG

Cryptographically Secure Pseudorandom Number Generator — an algorithm that produces random numbers indistinguishable from true randomness for cryptographic purposes. window.crypto.getRandomValues is a browser CSPRNG backed by OS entropy.

Entropy (bits)

A measure of unpredictability expressed as log2(possible combinations). A password with 70 bits of entropy has 2^70 possible values — the larger the number, the more resistant the password is to brute-force attacks.

Character Set

The pool of characters a password is drawn from. Typical sets are uppercase (A–Z, 26 chars), lowercase (a–z, 26 chars), digits (0–9, 10 chars), and symbols (!@#$%^&* etc., ~32 common chars). Larger pools increase entropy per character.

Brute-Force Attack

A password-cracking method that tries every possible combination of characters systematically. The time required grows exponentially with password length and charset size, which is why entropy is the primary measure of password strength.

Ambiguous Characters

Characters that look visually similar in many fonts and can be misread when transcribed manually: 0 (zero) and O (capital O), 1 (one) and l (lowercase L) and I (capital i). Excluding them reduces transcription errors without meaningful entropy loss for long passwords.

NIST SP 800-63B

A US National Institute of Standards and Technology publication that provides guidelines for digital identity and password policy. Key recommendations include favouring length over complexity rules and not requiring periodic rotation without evidence of compromise.