ToolsEveryday

Passwords & IDs

Strong random passwords with their exact strength, UUIDs, ULIDs and secret keys, all from your browser's secure random number generator. You can also take any UUID apart to see its version and when it was made.

Runs entirely in your browser

How this works

Everything happens in this page's JavaScript, on your device. Nothing is sent to abbott.cloud or anywhere else, so the request log below stays empty.
Randomness comes from crypto.getRandomValues, your browser's cryptographically secure random number generator, which the operating system seeds.
To pick one of n characters, the page takes a random 32-bit number. If it falls in the incomplete stretch at the top that isn't a whole multiple of n, it's thrown away and another is drawn (rejection sampling). The remainder after dividing by n is then equally likely to be any character. Plain "random number mod n" would favour some characters slightly.
With "at least one from each set", a password that misses a set is thrown away and a whole new one is made. So every password that meets the rules is equally likely. The usual shortcut, placing one character from each set and shuffling, isn't: it makes passwords with exactly one digit or symbol too likely.
Strength is counted exactly: how many passwords the settings allow (by inclusion–exclusion when every set must appear), as bits of entropy. Because each character is random, that's the real strength, not an estimate.
Version 4 UUIDs come from crypto.randomUUID. Version 7 UUIDs (RFC 9562) and ULIDs start with the time in milliseconds; several made in the same millisecond count upwards from a random start, so they stay in order (RFC 9562 §6.2).

What's kept: nothing. What's made here exists only on this page until you leave or generate again. Your settings, such as the length, go in the page's address so you can share them, but never a password or key. A copied password stays on your clipboard until you copy something else.

Limitations:

The time to guess assumes an attacker with a copy of a site's password database, trying a trillion guesses a second against a fast hash. Sites that use a slow hash such as bcrypt or Argon2 make it far longer.
The strength only holds while the password is used exactly as made. Changing it by hand makes it more predictable.

Code: generate.js (this page), lib/random.js (random numbers, passwords, strength, UUIDs and ULIDs), bytes.js (hex and Base64).

Passwords & IDs

Passwords

UUIDs and ULIDs

Random bytes for keys and secrets

Decode a UUID