Encrypted secure password automatic generation generator (no registration required) | ZeroTools

This password generator allows you to configure character length, generation count, candidate character types, and similar character exclusion, creating candidates upon clicking "Regenerate Passwords".

Default values are 16 characters, 3 items, with uppercase, lowercase, numbers, and symbols all enabled, as well as similar character exclusion enabled.

You can choose a count of 1, 3, 5, or 10 items. Length can be specified from 4 to 64 characters using either the numeric input field or the slider.

When changing settings, the on-screen theoretical bit strength updates according to the new character pool and length. On the other hand, previously generated strings do not change merely by altering settings.

When candidates under new conditions are needed, click the regenerate button. For instance, if you change length to 32 while 16-character results remain displayed, the theoretical value updates for 32 characters, but the result field remains 16 characters until regenerated.

To avoid confusing settings with displayed results, regenerate after making modifications.

Disabling all character types leaves no candidate characters, making theoretical value measurement impossible. Regenerating in that state clears previous results and displays an error requesting you to select at least one character type.

Likewise, if Web Crypto is unavailable and secure random numbers cannot be acquired, the tool does not fall back to Math.random, but instead clears results and shows an error.

Generated results can be copied individually via the copy button on each row. Batch copying, file saving, generation history, result sorting, and direct registration to password managers are not provided.

Before adopting candidates, verify the destination service's minimum and maximum character lengths, permitted symbols, and mandatory character types.

The baseline character pool consists of 26 uppercase letters, 26 lowercase letters, 10 digits, and 29 symbols. When selecting all four categories with similar character exclusion disabled, the total is 91 characters.

Candidate symbols encompass 29 built-in characters including exclamation marks, at signs, number signs, dollar signs, percent signs, carets, ampersands, parentheses, square brackets, punctuation marks, and operators.

Features for excluding arbitrary individual symbols or entering custom user character sets are not provided.

Enabling similar character exclusion removes uppercase I and O, lowercase l and o, digits 0 and 1, and the vertical bar symbol | from candidates.

As a result, uppercase becomes 24 types, lowercase 24 types, digits 8 types, and symbols 28 types, yielding a default character pool of 84 characters.

Exclusion is a setting to reduce visual misreading during transcription, not a process that automatically increases password length.

Reducing the character pool from 91 to 84 slightly lowers the theoretical bit strength calculated for the same length.

The generation function reads received character sets in JavaScript code point units and consolidates any duplicate characters into a single instance.

While current built-in sets have no intentional duplicates, this processing avoids increased occurrence rates caused by overlapping candidates.

Because custom input fields for freely entering emoji or other characters do not exist on this screen, users do not directly configure code point processing.

Enabling "Numbers" or "Symbols" merely adds those types to the candidate pool. There is no routine that pre-selects at least one character from each enabled type.

Even if drawing 16 times from the default 84 characters yields no digits at all, that result is displayed as-is without substituting characters to inject digits.

Consecutive identical characters are neither excluded nor redrawn. If your destination service requires at least one uppercase, lowercase, digit, or symbol, inspect individual results and regenerate until a candidate satisfying those conditions appears.

Selecting each character position utilizes the shared function secureRandomString. This function receives character length and character pool, calling secureRandomInt for each position.

secureRandomInt retrieves values into a Uint32Array via globalThis.crypto.getRandomValues in browser environments. In the W3C Web Cryptography specification, getRandomValues is defined as an API that generates cryptographically strong random values.

However, the W3C specification does not establish an information-theoretic lower bound for entropy contained in cryptographically strong values.

Which hardware sources the browser or OS employs cannot be verified from this page implementation either. Consequently, one cannot assert that specific entropy sources like thermal noise or disk activity are utilized, nor mathematically guarantee that output prediction is impossible.

What this tool performs is processing to map values provided by Web Crypto onto character selection without bias.

Candidate counts for 32-bit unsigned integers equal 2 to the 32nd power, which is not evenly divisible by 84 or 91. Simply using the remainder of dividing random values by pool size slightly favors certain characters corresponding to fractional leftovers.

secureRandomInt calculates the maximum range evenly divisible by pool size, discarding values above that upper limit and re-drawing.

For the initial 84-character pool, 2 to the 32nd power divided by 84 leaves a remainder of 4. Therefore, values from 0 through 4,294,967,291 are accepted, while drawing any of the 4 values from 4,294,967,292 through 4,294,967,295 triggers a re-draw.

Because the remainder of accepted ranges divided by 84 determines character positions, simple modulo assignment bias is avoided under the assumption of a uniform random source.

While re-draw counts have no fixed ceiling, the probability of discarding values in a normal 84-character pool is negligible.

Estimated bit strength on screen is not a value derived from analyzing actual passwords. Taking selected character pool count as N and specified length as L, it calculates L * log2(N).

It serves as a theoretical reference representing candidate space in bits when each position is drawn under identical conditions from the entire pool.

Under default settings, 16 * log2(84) yields approximately 102.3 bits, while 91 characters with exclusion disabled yields about 104.1 bits.

Display labels span four tiers: Under 40 bits, 40 to under 60 bits, 60 to under 80 bits, and 80 bits or more. Gauge widths use fixed scores of 20, 40, 75, and 100 respectively.

This 100 does not denote 100% security; it merely represents the 80+ bits bracket at maximum gauge width. For instance, 12 characters drawn solely from 24 excluded lowercase characters computes 12 * log2(24) at roughly 55.0 bits, placing it in the 40 to under 60 bits bracket.

The estimation formula inspects only candidate counts and length from generation settings. It does not inspect whether numbers or symbols are actually present in output results, whether characters repeat, whether strings resemble dictionary words, or whether they match breached password corpora.

Without inputs for destination hashing methods, rate limits, or attacker computing capacity, cracking time is not calculated. Thus, an "Estimated 80+ bits" label is not a guarantee that a specific account is secure or that non-brute-force attacks are prevented.

Immediately after altering settings, strength displays may reflect new settings while result fields still show strings generated under previous configurations.

To align theoretical values with individual results, regenerate after modifying settings. If additional rule verification against actual strings is required, values can be manually entered into related strength diagnostic tools, though such diagnostics also cannot guarantee future safety.

The copy button writes the target entry to the browser's Clipboard API. Only when writing succeeds does the button switch to "Copied" for 2 seconds.

If writing fails due to permissions or environment constraints, an error appears without showing copied status. Always verify contents after pasting critical results into destination services.

Reverting button appearance after 2 seconds is all that occurs. There is no routine that automatically clears clipboards by writing empty strings or alternative random values.

Whether operating systems or clipboard manager utilities retain contents cannot be controlled from this page. If post-copy retention is a concern, overwrite clipboard data manually using methods suited to your environment, such as copying alternative text after storing values.

Generated candidates are retained as React state and rendered as strings in DOM elements. Storage in LocalStorage or files, past result lists, and registration with browser password managers do not exist.

Nor does code explicitly overwrite JavaScript string memory with zeroes, meaning physical memory states after closing the page are not guaranteed.

The generator component contains no routine that transmits generated strings to servers for generation purposes. However, separate network requests concerning the broader page may occur, including asset delivery for rendering, analytics, and advertisements.

Distinguish between generation logic lacking transmission routines and pages lacking all network activity.

When using generated candidates, choose distinct values for each account and avoid reuse. Where supported, storing passwords in a dedicated password manager reduces manual memorization and transcription.

NIST SP 800-63B-4 requires verifiers offering single-factor authentication to mandate at least 15 characters, and references utilizing password managers to select and store unique passwords.

Because this reflects service design requirements for verifiers, it does not impose a uniform setting mandate across all end users.

Long, random passwords expand search space, but they do not prevent attacks distinct from brute force, such as phishing leading to rogue websites, keyloggers on devices, or session hijacking.

Where supported by services, combine multi-factor authentication or passkeys, and confirm recovery options and registered devices.

Avoid transmitting plaintext passwords via email or chat.

If you wish to evaluate actual strings from different perspectives, consider password strength analysis; for API key formats like Hex, Base64, Base64URL, or UUID, utilize a secure token generator; to inspect time-based one-time codes from shared secrets, a TOTP generator and verifier is appropriate.

These operate as separate screens and do not automatically transfer generated strings or configurations. Separate your workflows and check input premises upon navigating.