Home / Passwords & Secrets Tools
Passwords & Secrets Tools
Generate strong passwords, measure entropy, create API keys and manage password policies.
- Password Generator Create strong, random passwords with custom length and character sets — generated securely in your browser.
- Password Strength & Entropy Checker Measure a password's entropy in bits and estimate how long it would take to crack.
- API Key & Secret Generator Generate cryptographically secure API keys and secrets in hex, Base64url or alphanumeric.
- UUID Generator (v4 & v7) Generate random v4 UUIDs or time-ordered v7 UUIDs in bulk, ready to copy.
- Bcrypt Hash Generator & Checker Hash a password with bcrypt at an adjustable cost factor, or verify a password against a hash.
- .htpasswd Generator (bcrypt) Create a secure Apache/nginx basic-auth entry with a bcrypt-hashed password.
Passwords & Secrets guides
All guides →- Bcrypt vs SHA-256: Why You Don't Hash Passwords with SHA SHA-256 is fast — which is exactly why it's the wrong way to store passwords. Here's why bcrypt (or Argon2) wins, and how salting and cost factors work.
- How to Create a Strong Password (and Why Length Wins) Forget swapping letters for symbols. Here's what really makes a password strong — entropy, length, uniqueness — and the simple system that beats memorising rules.
- What Is a UUID? v4 vs v7 Explained What a UUID actually guarantees, why collisions are a non-issue, and why v7 is quietly replacing v4 for database keys.
- What Is HTTP Basic Authentication? The simplest way to password-protect a page — and its big caveat. How Basic Auth works, why HTTPS is mandatory, and where it fits.
- What Is an API Key? (And How to Keep It Secret) What an API key actually is, how it differs from a password or token, and the handful of habits that keep one from leaking into a breach headline.
- What Is Two-Factor Authentication (2FA)? Why a password alone isn't enough — how 2FA works, the difference between SMS codes, authenticator apps and hardware keys, and which to choose.
- What Is a Salt in Password Hashing? Why two people with the same password should never have the same hash — what a salt is, how it stops rainbow tables, and how it differs from a pepper.
- What Is Credential Stuffing? (And How to Stop It) One breach, many break-ins: how attackers replay leaked passwords across every site — and why reuse, not weak passwords, is the real vulnerability.
- What Is a Password Manager? (And Why You Need One) You can't memorise a unique random password for 100 sites — and you shouldn't try. How password managers work, and why they're the single best security upgrade.