Password, UUID, and hash generator

Passwords

Choose a length from 8 to 128 and the sets you want: lowercase, uppercase, digits, and symbols. The generator draws from the Web Crypto random source, not from Math.random. Each index is taken with rejection sampling so the leftover at the end of the 32-bit range does not bias the alphabet. When the length allows it, the password includes at least one character from every set you turned on, and the characters are shuffled afterward. “Avoid ambiguous characters” drops 0, O, o, 1, l, and I, which helps when someone has to type the password off a screen.

A longer password from a full alphabet beats a short password with a clever substitution. Eight characters is the floor this form allows, and it is short for anything an attacker can guess offline. Use a length you can store in a password manager. This page does not store the password, does not have an account, and does not transmit it. Copy it and put it in your manager. Closing the tab drops it.

UUID and hash

UUID v4 is random, with the version and variant bits set the way RFC 9562 requires. UUID v7 puts a 48-bit millisecond timestamp in front and fills the rest with random bits, so identifiers sort roughly by creation time. Neither version includes your name or your machine’s MAC address. They are identifiers, not secrets. Do not use a UUID as a password.

The hash box computes SHA-256, SHA-384, or SHA-512 of the text you type, as hexadecimal. The same text always produces the same hash. That is useful for a checksum. It is a poor way to store a password, because these hashes are fast and unsalted. Password storage wants a slow function such as bcrypt, scrypt, or Argon2, with a salt. bcrypt’s cost is an exponent: cost 12 means 2^12 rounds of the expensive step, and each extra point doubles the work. This page explains that and does not emit a bcrypt hash. Hashing a password with SHA-256 here will not produce a string you should put in a user table.

If you are decoding a credential rather than creating one, use the JWT decoder. It will show you the claims and it will also refuse to pretend the signature was checked.

Common questions

Can you show me the password later?

No. It was generated on your device and it was not saved. Generate another one. If you already stored the first in a manager, you do not need this page to remember it.

Is UUID v7 safer than v4?

They solve different problems. v4 is unstructured randomness. v7 leaks the creation time to anyone who can see the identifier, and in return it indexes nicely. Pick v7 when you want sort order. Pick v4 when you do not want the time embedded.

Why will you not reverse a hash?

A cryptographic hash is not encryption. Many texts can share no short inverse, and this page does not search for one. If you hashed the wrong text, hash the right text.

Which symbol set is this?

A short ASCII set that is unlikely to be eaten by a shell quote: punctuation such as !@#$%^&* and a few brackets. If a site rejects a symbol, turn symbols off or generate again. The entropy is in the length and the size of the set, not in one particular character.