Generator Tools
Generators for creating random identifiers, secure passwords, and QR codes — all computed locally in your browser using cryptographically secure randomness where it matters.
Quick tasks
One click opens the tool already set up for the job.
Online Generator Tools - Identifiers, Passwords and QR Codes
Three of the most common things a developer needs to produce out of thin air are a unique identifier, a secret nobody can guess, and a machine-readable link. The tools in this category cover all three, and they share a property that matters more than any feature: the randomness comes from your own browser's cryptographic generator, and the result is never transmitted anywhere.
What is in this category
| Tool | What it produces | Reach for it when |
|---|---|---|
| UUID Generator | UUID v1, v3, v4, v5 and v7, one at a time or a thousand at once | You need a primary key, a correlation ID or a filename that cannot collide |
| Password Generator | Random passwords and passphrases with adjustable length and character sets | Creating a credential that should never be guessed or reused |
| QR Code Generator | QR codes for URLs, text, Wi-Fi networks and contact details | A link has to travel from a screen or a printed page into someone's phone |
| CSS Generator | Gradients, box shadows and rounded corners built with sliders and a live preview | You want an effect to look right by eye before you paste its CSS into a stylesheet |
| Meta Tag Generator | SEO, Open Graph and X card tags with live Google, Facebook and X previews | A page is about to go live and should look right in search results and when shared |
The thing that makes a generator trustworthy
Any language can produce a random-looking number. Very few of those functions are safe for anything that must be unguessable. Math.random() in JavaScript is a fast pseudo-random generator seeded from a small amount of state; given enough output an attacker can predict the rest of it. It is fine for shuffling a carousel and unfit for generating a password or a session token.
The correct source in a browser is crypto.getRandomValues(), which draws from the operating system's cryptographically secure pool - the same one that seeds TLS. Both the password generator and the UUID generator here use it. It is worth asking the question of any generator you use, because from the outside the two look identical: both produce strings that seem random.
The second half of trustworthiness is where the value goes. A password generated on a server has been transmitted at least once and may exist in a log, a cache or a backup. Generating in the browser means the only copy is the one on your screen until you decide to store it.
Choosing an identifier format
A UUID is 128 bits, written as 36 characters. Its point is that two machines that have never communicated can each mint one and be confident they will not collide. That property is what lets a phone create records offline, a queue worker reference a row before it is written, and two databases merge without renumbering.
Version 4 is the general-purpose default: 122 random bits and no embedded metadata. Version 7 puts a millisecond timestamp in the leading bits, so values sort chronologically as plain strings and new rows land at the end of a database index instead of scattering through it - the right choice for a primary key in a busy table. Versions 3 and 5 are deterministic: the same namespace and name always produce the same UUID, which is how you derive a stable ID from something like a URL. Version 1 mostly turns up when reading old data.
Sequential integers leak information that UUIDs do not. /invoice/1042 tells anyone who sees it roughly how many invoices you have issued and invites them to try 1043. That is a design consideration, not a security control, but it is a real one.
What actually makes a password strong
Length beats complexity. Each additional character multiplies the search space by the size of the alphabet, while adding a symbol to a short password multiplies it once. A 20-character lowercase-and-digit password is far harder to attack than an 8-character one with a symbol and a capital, and considerably easier to type.
The complexity rules most sites enforce - one uppercase, one digit, one symbol - were designed to stop humans choosing password. They do not help a generated password, and they push people toward predictable patterns like a capital at the front and a 1! at the end. Set a generated password to the maximum length the site accepts and let the character set be whatever it will take.
- Never reuse. Credential-stuffing attacks work because one breached site hands attackers a working login for twenty others.
- Use a password manager. A generated password you cannot remember is the point; something has to store it.
- Watch for ambiguous characters. If a password will be read aloud or typed from paper, exclude
l,I,1,Oand0. - Passphrases have a place. Several random words are memorable and long, which suits the handful of passwords you must actually recall - your device login, your password manager itself.
- Rotation on a schedule is out of favour. Modern guidance is to change a password when there is reason to think it is exposed, not every ninety days, because forced rotation produces predictable variations.
QR codes: what they carry and what they cannot
A QR code is a two-dimensional barcode holding a short piece of text - most often a URL, but also Wi-Fi credentials, a phone number, a calendar event or a vCard. It is not a link to a hosted image; the data is in the pattern itself, so a code you generate keeps working forever with no service behind it.
The QR code generator here builds the pattern in the browser, which means the URL you encode is not logged by a third party - worth knowing when the link is an internal dashboard or a signed URL. Two practical points: error correction lets a code still scan when part of it is damaged or covered by a logo, at the cost of a denser pattern, and contrast matters more than size. A code needs a quiet margin around it and dark-on-light colouring; inverted or low-contrast codes fail on many scanners.
Related categories
- Developer tools - hash a generated value when you need a fingerprint of it, or read the timestamp a v1 or v7 UUID carries.
- Encoding tools - generated secrets are usually Base64-encoded before they land in a config file or a header.
- Text tools - validate the JSON that a batch of generated identifiers is about to be pasted into.