Password Generator
Generate strong, random passwords instantly — uses Web Crypto API, nothing sent to servers
How password length affects crack time
Trivially crackable by any modern GPU. Never use 6-character passwords for anything.
Common minimum requirement but dangerously short. Most brute-force attacks crack 8-character passwords within a day.
The sweet spot for most accounts. Balances security and memorability. Recommended by NIST for general use.
Effectively uncrackable by brute force. Use for banking, primary email, and password manager master passwords.
Crack times assume mixed characters (upper, lower, digits, symbols) at 10 billion guesses/second.
Generated in your browser, never transmitted
Every password is created using the Web Crypto API (window.crypto.getRandomValues), which taps into your operating system's cryptographic random number generator. No password is ever sent to any server, logged, or stored. The source code runs entirely client-side — you can verify by checking the browser's Network tab during generation.
Frequently Asked Questions
Are the generated passwords sent to any server?
No. All passwords are generated entirely in your browser using the Web Crypto API's cryptographically secure random number generator. Nothing is ever sent to Utilra's servers or stored anywhere.
What makes a password strong?
A strong password combines length (at least 12 characters), mixed character types (uppercase, lowercase, numbers, symbols), and true randomness. Utilra uses the Web Crypto API which provides cryptographically secure randomness — far superior to Math.random().
Can I use these passwords for my accounts?
Yes. These passwords are generated with cryptographic randomness and contain no personal information. We recommend using a password manager to store them securely.
How long should my password be?
At least 12 characters for important accounts, 16+ for banking and email. Each additional character exponentially increases the combinations an attacker must try. A 12-character mixed password has over 475 trillion possible combinations.
Should I use a different password for every site?
Absolutely. If one site is breached and you reuse that password, attackers test it on banking, email, and social media within hours. Use a password manager to store unique passwords — you only need to remember one master password.
Key Terms
Web Crypto API
A browser-native API that generates cryptographically secure random numbers — used here to ensure passwords are truly unpredictable.
Entropy
A measure of password randomness in bits. Higher entropy means harder to crack. A 12-character mixed password has roughly 79 bits of entropy.
Brute Force
An attack that tries every possible character combination. At 10 billion guesses per second, a 12-character mixed password takes over 1,500 years to crack.