Utinzo

Password Generator

Generate strong, random passwords with custom length and character sets.

Did this tool work for you?

How to use this calculator

  1. 1

    Set the desired length (longer = stronger).

  2. 2

    Choose which character types to include.

  3. 3

    Set how many passwords to generate.

  4. 4

    Each calculation generates a new set of passwords.

Frequently asked questions

What random source does this generator use?

The browser’s cryptographically secure generator, crypto.getRandomValues, not Math.random. Each character position is chosen with rejection sampling, which discards the few 32-bit values that would make some characters slightly more likely than others, so every character in the active set is equally probable. If a browser has no such source, the tool shows an error instead of falling back to Math.random.

Is it safe to use passwords from a web page?

The generation runs in your browser and the tool’s code makes no network request with the result. Even so, a password you see on screen can be seen by shoulder-surfers, screen sharing or browser extensions with page access. Copy it straight into a password manager, and do not reuse a password that you have posted publicly or pasted into a chat.

What are the length and quantity limits?

Length is forced into the range 4 to 128 (a 0, which is also what an emptied box becomes, gives the default of 16, 2 becomes 4, 200 becomes 128), and you can generate 1 to 20 passwords at once. Very short lengths are allowed, but the Strength line will rate them Weak.

Which symbols can appear, and can I exclude some?

The symbol set is fixed at 26 characters: ! @ # $ % ^ & * ( ) - _ = + [ ] { } | ; : , . < > ?. You can only switch the whole group on or off. Some websites reject certain symbols or limit length, so if a site refuses a password, regenerate with symbols off and a greater length, which usually restores strength.

Does every password contain at least one of each type?

No. Characters are drawn from the combined set with no per-category guarantee. A 16-character password with all four groups switched on may, rarely, contain no digit. If a site requires one of each type, generate again until it passes, or add the missing character in the middle by hand.

How is entropy calculated, and what do the labels mean?

Entropy is the length multiplied by log2 of the character-set size, rounded down. That figure applies only because every character is chosen uniformly and independently. Labels are thresholds in the code: 48 bits or more is Moderate, 72 is Good, 96 is Strong and 128 is Very Strong, with anything below 48 marked Weak. A 6-digit PIN scores 19 bits and shows Weak.

Does it avoid look-alike characters or offer a passphrase mode?

No. O, 0, I, l and 1 can all appear, which matters if you will type the password from a printout. There is also no passphrase (word-based) option, and the generator does not check the result against breached-password lists.

About password generator

Random passwords: length, character sets and entropy

How a password is produced

The tool joins the groups you switch on into a single alphabet of 26 uppercase letters, 26 lowercase letters, 10 digits and 26 symbols, up to 88 characters in all. For every position it requests random 32-bit numbers from the browser’s secure source and uses one that fits evenly into the alphabet. Because values from the incomplete top block are thrown away, no character is favoured. The result is as random as the browser’s generator, and each position is independent.

Worked example: the default settings

Length 16 with all four groups and 3 passwords gives three 16-character strings, labeled Password 1 to Password 3, followed by Entropy: 103 bits, Strength: Strong and Charset size: 88 characters. A sample from one run was zIr5x[F,*-^hxv]i, shown only to illustrate the shape. It is random on every click, so never reuse a sample that has been published on a web page.

Worked example: longer versus more complex

Length 20 with symbols switched off uses 62 characters and reports 119 bits, which is higher than the default 103 bits even though it contains no symbols. Eight characters from lowercase letters and digits (36 characters) reports 41 bits and is rated Weak. Twelve digits alone gives 39 bits, again Weak. Each added character multiplies the number of possibilities by the size of the alphabet, which is why length beats symbol variety.

Reported entropy for sample settings
LengthCharacter groupsSet sizeEntropyLabel
16Upper, lower, digits, symbols88103 bitsStrong
20Upper, lower, digits62119 bitsStrong
8Lower, digits3641 bitsWeak
12Digits only1039 bitsWeak
6Digits only1019 bitsWeak
128 (maximum)Upper, lower, digits, symbols88826 bitsVery Strong

What entropy tells you and what it does not

Entropy measures how many equally likely passwords the settings could produce, and every extra bit doubles that count. It says nothing about reuse or theft: a perfectly random password that you use on two sites is only as safe as the weaker site. It also does not account for sites that cap length or strip symbols. The 128-character maximum gives 826 bits, far more than any site needs.

Limits to keep in mind

The tool cannot store passwords, check them against known breaches or insist on a character from every group, and its symbol list is fixed. Use a password manager to keep results, and turn on two-factor authentication where it is offered. Choose a length of 16 or more for accounts that matter, shorter only where a site forces it.

Password Generator – Utinzo

Learn more from an authoritative source:

Wikipedia
Related tools

Results are estimates for informational purposes only and do not constitute professional financial, medical, legal, or technical advice. Read full disclaimer →