Generators
Passwords, colours, gradients, contrast checks and placeholder text.
6 free tools · nothing is uploaded
About Generators
Generators produce something from nothing, which makes where they run unusually important. A password generated on a server is a password that existed, however briefly, on someone else's machine and possibly in their logs. There is no way to verify what happened to it.
The Password Generator here uses the browser's own cryptographically secure random source, in your tab, and the result is never transmitted. That is the only arrangement under which generated credentials are trustworthy — and the same applies to the strength checker, which analyses a password you already use without sending it anywhere.
What do you need to make?
- A password
- The Password Generator builds random passwords with configurable length and character sets. Length beats complexity: a long passphrase of ordinary words is harder to crack than a short string of symbols, and far easier to type.
- A verdict on a password you already use
- The Password Strength Checker estimates crack time and explains what is weak about it. It runs locally, so it is safe to test a password you actually use — which is the only test that tells you anything.
- Colours
- The Color Picker converts between HEX, RGB and HSL and generates shades. The CSS Gradient Generator builds linear and radial gradients and gives you the CSS.
- An accessibility check
- The Contrast Checker measures a foreground and background pair against WCAG AA and AAA. Worth running on any colour choice that carries text — failing contrast is the most common accessibility defect on the web and among the easiest to fix.
- Filler text
- Lorem Ipsum produces placeholder paragraphs for mockups.
If you generate a password here, put it straight into a password manager. A strong password you cannot remember and did not save is worse than a weak one you can.
Frequently asked
Are the generated passwords actually random?
They come from crypto.getRandomValues(), the browser's cryptographically secure random source — not Math.random(), which is predictable and unsuitable for anything security-related.
Is the password sent anywhere before I see it?
No. It is generated in your browser and never transmitted. Nothing is logged, and closing the tab is enough to be rid of it.
What actually makes a password strong?
Length, far more than complexity. A long passphrase of ordinary words beats a short string of symbols, because attackers guess by pattern rather than by character. Uniqueness matters just as much: a strong password reused everywhere fails the moment any one site is breached.
Are UUIDs guaranteed to be unique?
Not guaranteed, but the odds are negligible — a v4 UUID has 122 random bits, so a collision is far less likely than a hardware failure. For practical purposes you can treat them as unique.