About this tool
Two separate utilities live on this page: a password generator and a hash calculator. Both run offline in your browser, so none of it is sent anywhere over the internet.
The password generator pulls from the browser's cryptographically secure random number source, crypto.getRandomValues, rather than the weaker Math.random() that a surprising number of online generators still use. Pick a length from 8 to 64 characters, choose which character groups to include, and optionally exclude look-alike characters such as O, 0, l and 1. A strength meter shows the entropy in bits. As a rough guide, 12 random characters from a mixed set is a reasonable floor for an ordinary account, and 16 or more makes more sense for email, banking, or a password manager's own master password.
Switch to the hash side and you get MD5, SHA-1, SHA-256, SHA-384 and SHA-512 calculated together for any text or file. A hash is a fixed-length fingerprint of whatever you feed it: the same input always produces the same output, and changing a single character produces a completely different one. That makes hashes useful for verifying downloads, spotting a changed file, or comparing data without ever storing the data itself. Enter a secret key and you also get an HMAC, which proves a message came from someone who actually holds that key.
MD5 and SHA-1 are included because plenty of legacy systems still expect them, but both are considered broken for anything security-sensitive, since deliberate collisions are possible. Stick to SHA-256 or stronger where it matters. And whatever you do, don't hash passwords this way on a server: a plain fast hash is the wrong tool for that job, use bcrypt, scrypt or Argon2 instead.
