Skip to content
Toolars
Explore
Report bug

Utilities · Local utility

Password Generator

Generate 8–128-character passwords from selected character sets with browser Web Crypto; every chosen set appears at least once. Copy to the clipboard or download plain text; generation runs in this tab. The same page creates or verifies Bcrypt hashes in a local Worker (cost 4–12; password limit 72 UTF-8 bytes).

Task path / input to outcome

Set the password length

Runs locally · Nothing is uploaded

How Password Generator works, privacy, and related tools

Task path / input to outcome

How to generate a strong random password

  1. 01

    Set the password length

    Set a length from 8 to 128 characters (default 24) and choose the character sets. The bit figure is a theoretical upper bound from the length and alphabet, not a strength score. Changing the settings clears the previous result.

  2. 02

    Choose the character sets

    Under Character sets, toggle Lowercase a–z, Uppercase A–Z, Digits 0–9, and Symbols — a 23-character set covering !@#$%^&*()-_=+[]{};:,.? and friends. At least one set must stay enabled, and every selected set is guaranteed to appear in the password at least once before shuffling. When a target system restricts symbols, turn that set off rather than regenerating until the output happens to comply.

  3. 03

    Generate the password

    Press Generate password. Web Crypto and rejection sampling select one character from each enabled set, fill the remaining positions from the combined alphabet, then shuffle with Fisher–Yates. Every selected set appears at least once; complete passwords are not sampled uniformly from all valid combinations.

  4. 04

    Copy or download the secret

    Use Copy output to place the password on the system clipboard and paste it into a password manager; clear the clipboard according to your device's policy. Download saves toolars-strong-password.txt as unencrypted plain text, so protect or remove that file after saving the password. Generation itself runs in this tab without an upload. Reset clears the workspace result but cannot revoke copies already placed on the clipboard, disk, or another app.

  5. 05

    Create or verify a Bcrypt password hash

    Use the generated secret or enter another password, choose cost 4 through 12, and create or verify a real Bcrypt hash in the isolated Worker. Passwords over 72 UTF-8 bytes are rejected instead of silently truncated.

Tool facts

Processing
In your browser
Input leaves this device
Never
Retention
Nothing is stored
Price
Free

Your input stays in the browser.

Password Generator uses its verified local execution path and does not create a hidden input or output history.

Local execution

Runs inside the current browser tab.

No hidden processing

Active tool data never becomes a Toolars document record.

No account required

Use the core workflow without creating a profile. Favorites sync to your account after you sign in.

Immediate reset

Clear the tab and the active working data is gone.

What Password Generator actually does

Create a long, unique password that meets the target service’s character rules, then save it in a password manager. Disable symbols only when the service requires it; the displayed bit bound does not assess reuse or exposure.

Common questions

How random are the passwords?
Every character comes from the browser's Web Crypto API via rejection sampling: random 32-bit values that would skew the distribution are discarded and redrawn, which removes the modulo bias of naive random pickers. One character per enabled set is placed first so the policy is guaranteed, the rest is filled from the combined alphabet, and the finished password passes through an unbiased Fisher–Yates shuffle so those guaranteed characters land in unpredictable positions.
What lengths and character sets are allowed?
Any integer length from 8 to 128 characters, combining lowercase letters, uppercase letters, digits, and a 23-character symbol set in any mix. Turning all four sets off is rejected with a message asking for at least one character set. The default policy is 24 characters with all four sets enabled, and Reset returns to it at any time.
What does the bit upper bound mean?
Upper bound from length and alphabet only; requiring every selected class changes the distribution. This is not a password strength score. Use long, unique passwords.
Is the password stored or uploaded?
Generation uses browser Web Crypto in the current tab; this tool does not upload or persist the result as a site record. Copy places it on the system clipboard, where other software or clipboard history may retain it. Download writes an unencrypted text file. Reset or closing the tab clears the workspace view but cannot erase copies you made elsewhere. Store the password in a trusted manager and handle clipboard and file copies according to your device's security settings.
Is Bcrypt encryption, and what limits apply?
Bcrypt is a salted one-way password verifier, not encryption and not reversible. Cost is bounded from 4 to 12, work is terminated on timeout, and passwords over 72 UTF-8 bytes are rejected explicitly.

Continue in Files & Utilities

Related tasks, not a dead end.

Move into another focused workspace without returning to the full index.

List Randomizer

Shuffle lists of up to 5,000 items with an unbiased Fisher-Yates shuffle powered by Web Crypto; duplicates keep their independent chances.

Edit

Image to Text OCR

Extract printed text from PNG or JPEG images in 13 languages — each model pack downloads on demand, recognition runs locally, and downloaded packs work offline.

Create

Subtitle Converter

Convert plain-text subtitles between SRT and VTT and shift cue timing by whole milliseconds — up to 1 MiB and 10,000 cues per run.

Convert

QR Code Reader

Decode one QR code from a PNG or JPEG image using local Canvas and a Web Worker — no cloud fallback, no camera, links never opened.

Create