Free Developer Tools

Cryptographically-secure utilities every developer reaches for — strong passwords, UUIDs, hashes. Runs in your browser using window.crypto; nothing is uploaded.

100% private — uses browser-native crypto. Nothing uploaded.

🔐Strong Password GeneratorRandom secure passwords with adjustable length and character sets. 🆔UUID GeneratorGenerate v4 UUIDs / GUIDs in bulk with copy-all. #️⃣Hash GeneratorMD5, SHA-1, SHA-256, SHA-384, SHA-512 of any text.

Picking the right tool for the job

Three utilities sit above: a password generator, a v4 UUID generator, and a hash generator covering MD5 through SHA-512. Their failure modes have nothing in common.

Passwords

Length beats character classes. Sixteen characters drawn uniformly from the 62 alphanumerics carry about 95 bits of entropy; twelve carry about 71. NIST SP 800-63B dropped mandatory composition rules and forced rotation for that reason.

The random source matters more than the ruleset. Math.random() is a fast PRNG whose internal state can be recovered from a few outputs, so anything built on it is predictable. A sound generator pulls from crypto.getRandomValues and rejects out-of-range bytes rather than taking them modulo 62, which would leave the first eight characters of the alphabet likelier than the other fifty-four.

Identifiers

A v4 UUID is 122 random bits printed as 36 characters, mintable on the client with no server round trip. The tradeoff is that random UUIDs make poor clustered primary keys: consecutive inserts land in unrelated B-tree pages and write amplification climbs. For a sort or pagination key, reach for UUIDv7, which puts a 48-bit millisecond timestamp in the high bits so IDs order roughly by creation time. Version 4 stays right for request IDs and idempotency keys.

Read the nibbles on an ID you did not generate. In f81d4fae-7dec-11d0-a765-00a0c91e6bf6 the first character of the third group is the version, and 1 means the value carries a timestamp plus a node field that is usually the machine's MAC address, a leak if those IDs are public. The first character of the fourth group is the variant: 8, 9, a, or b under RFC 9562.

Hashes

MD5 collides in seconds, and SHA-1 fell to a chosen-prefix collision in 2020 for roughly $45,000 of GPU time. Neither is broken for preimages: nobody can produce a file matching a digest you picked in advance. That is why a vendor's MD5 still catches a truncated download and proves nothing against an attacker who controls both files. Use SHA-256 or longer for signatures, tokens, and content addressing.

Digest length identifies an unlabelled checksum: 32 hex characters is MD5, 40 is SHA-1, 64 is SHA-256, 96 is SHA-384, 128 is SHA-512. Passwords are a separate category. SHA-256 is fast, and fast is the wrong property, so reach for bcrypt, scrypt, or Argon2 in application code, and note that bcrypt truncates input past 72 bytes.

Why two hashes of the same text disagree

A mismatch nearly always means the bytes differ. The generator hashes exactly what you paste, so the culprits are characters you cannot see:

A trailing newline. SHA-256 of abc starts ba7816bf; with a newline appended it starts edeaaff3. Copying out of a terminal brings one along.
Line endings. A file checked out under core.autocrlf=true holds CRLF where the published digest assumed LF.
Encoding. é is the single byte 0xE9 in Latin-1 and the pair 0xC3 0xA9 in UTF-8. Hashing text hashes one encoding of it.
Invisible characters. A non-breaking space (0xC2 0xA0) or zero-width space (0xE2 0x80 0x8B) survives a paste and renders as nothing.

This tool takes text, not files. To check an installer or an ISO against a published digest, hash it locally with shasum -a 256 or certutil -hashfile; a textarea mangles binary data.

Common questions

Can two UUIDs ever be the same? In theory yes, in practice no. The realistic failure is a weak random source rather than the arithmetic, so a generator backed by crypto.getRandomValues matters more than the version.

Which hash should I use to verify a download? Whichever the publisher listed, since you can only compare against a digest that exists. If several are offered, take the longest. A matching MD5 tells you the file survived transit, not that nobody swapped it.

How long should a generated password be? Sixteen alphanumeric characters is a floor for anything you never type by hand, and there is no reason to stop there once a password manager holds it.

Is it safe to paste production data in? The work runs in JavaScript on your machine and no request carries the input anywhere. Clipboard history and extensions are still in scope on a shared machine.