UUID and password generator

How these values are generated

Both use crypto.getRandomValues, the browser's cryptographically secure random source. That matters: Math.random is fast but predictable enough that it must never be used for anything security-related.

UUID v4 in practice

A version 4 UUID is 122 random bits formatted as 36 characters. The practical appeal is that two systems can generate identifiers independently and effectively never collide, so a client can create a record id before the server has seen it.

The trade-off is database behaviour. Random identifiers scatter writes across an index, which fragments it; sequential integers or time-ordered identifiers such as UUID v7 and ULID keep inserts local and perform better as primary keys on large tables. A common compromise is an internal sequential key plus a public random identifier, so you get index locality without exposing row counts in your URLs.

Passwords: length beats complexity

Each additional character multiplies the search space. Adding symbols to a short password helps far less than making it longer. The entropy figure shown with each generated password is the number of random bits it carries — anything at or above roughly 80 bits is comfortably beyond brute force with current hardware.

Generated passwords are only useful with a password manager, since nobody memorises them. The practical setup is a manager holding unique long passwords for every account, protected by one strong passphrase you do memorise, with multi-factor authentication on the accounts that matter.

Ambiguous characters are deliberately excluded from the alphabets here — no lowercase l, uppercase I, capital O or zero — because they cause failed logins when a password is read aloud or copied by hand.

Questions

Are the generated values recorded?

No. They are produced in your browser and never transmitted. Reloading the page discards them.

Is UUID v4 guaranteed unique?

Not guaranteed, but the collision probability is negligible — you would need to generate billions before it became a practical concern.

Should I use this for production secrets?

For convenience values, yes. For long-lived production credentials, generate them inside the system that will hold them, so they never pass through a browser or clipboard.

More tools

Browse all free developer tools or read the guides.