11 generatorsWeb Cryptoruns in your browserno account
Strong, and it shows you why.
Passwords, passphrases, PINs, API keys, JWT secrets and UUIDs, generated by the Web Crypto API in this tab. Each one arrives with the number of bits behind it and how long it holds against three different attacks — because “strong” means nothing without a number.
decay-present-fringe-amend- Online, rate-limited
- centuries
- Stolen database, fast hash
- 23 minutes
- Stolen database, slow hash
- centuries
Passwords
For a person to type, or to remember
4Password Generator
;ly)AM>27.I%>k`!|UH}Secure random passwords with full control
Passphrase Generator
peaceful-setup-convoke-canvasMemorable XKCD-style word lists
Random PIN Generator
489373Numeric PIN codes of any length
Password Analyzer
72 bits · centuries · instantlyCheck strength, entropy, and crack time
Identifiers
For a database column
2Secrets
For a config file
5JWT Secret Generator
JDmmQBkofVU3vBvct4iY91vGgMss…Base64URL-encoded HMAC secrets
API Key Generator
sk_test_yfS97dEXm52VZj9JWxPZ…Stripe-style prefixed API keys
Webhook Secret Generator
whsec_JNbEkOfutRR3eM9XkOP9qy…whsec_-prefixed signing secrets
Session Secret Generator
1m5gXhqx9AAVJUToZ9KUE34kPnon…Signing keys for cookies and sessions
Random Token Generator
563b3ff5c14b5c89ed95654733b8…Hex, Base64, or Base64URL tokens
Security First
What the tool does and does not do with what it generates.
crypto.getRandomValues
Every value comes from the browser's own CSPRNG. Math.random appears nowhere in this tool.
Nothing is sent anywhere
The generator is JavaScript in this tab. No request carries a generated value, because there is no request — open the network panel and watch.
History stays in this browser
The last entries sit in this browser's localStorage and nowhere else. Clearing them is one button.
No account, no limit
Nothing to sign up for, nothing counted, no watermark on the output.
Common Use Cases
One click to generate the right credential for any service
Create a Wi-Fi Password
63-character mixed random string
GenerateGenerate PostgreSQL Password
24-char safe characters
GenerateGenerate Docker Secret
32-char hex token
GenerateGenerate JWT Secret
64-byte Base64URL HMAC secret
GenerateGenerate API Key
Prefix-based realistic API key
GenerateGenerate Session Secret
32-byte session signing secret
Generate
Part of the GenCore Ecosystem
Credential generator works great with other GenCore tools to create complete test profiles
Frequently Asked Questions
How secure are generated passwords?
All passwords are generated using crypto.getRandomValues(), the Web Crypto API’s cryptographically secure pseudorandom number generator. This is the same standard used by browsers for security-sensitive operations.
Are passwords generated locally?
Yes. All generation happens entirely in your browser. No data is sent to any server, and no credentials ever leave your device.
Do you store generated passwords?
No. Generated passwords are never stored on our servers. You can optionally save them to your browser’s localStorage (history feature), which stays on your device.
What password length should I use?
For most purposes, 16 characters provides excellent security. For master passwords or admin accounts, use 20-32 characters. Wi-Fi passwords should be 63 characters for maximum WPA2/WPA3 compatibility.
What is password entropy?
Entropy measures how unpredictable a password is, expressed in bits. Each bit doubles the difficulty of guessing. A password with 80+ bits of entropy is considered very strong against offline attacks.
What is a passphrase?
A passphrase is a sequence of random words (e.g., “correct-horse-battery-staple”). Passphrases are easier to remember than random character passwords while providing comparable or better security.
What is UUID?
A UUID (Universally Unique Identifier) is a 128-bit label used for unique identification. UUID v4 is randomly generated, while UUID v7 includes a timestamp component for time-ordered sorting.
What is a JWT Secret?
A JWT secret is a cryptographic key used to sign JSON Web Tokens (JWTs) via HMAC algorithms like HS256. It should be a high-entropy random string, typically 64 bytes encoded in Base64URL.
Pick what you need
Eleven generators, one tab, nothing stored.
Open the generator