Password & UUID Generator
Generate random passwords and UUIDs (v4 and v7) in your browser with the Web Crypto API, and inspect the version and timestamp of a UUID.
Password generator
Entropy = length × log2(number of possible characters). This estimate applies only to passwords generated at random, like the ones below.
Generated passwords
UUID generator
UUID inspector
Notes
- Passwords and UUIDs are generated in your browser with the Web Crypto random number generator. They are not sent to or stored by LeedyBox, so LeedyBox cannot recover them. Save passwords you keep in a password manager.
- Use a different password for each account and turn on two-factor authentication where it is available.
- The strength label is an estimate. It does not take into account how a service stores the password or whether the password has appeared in a data breach.
- A UUID v7 contains the time it was created, so anyone who sees it can read when it was generated. Use v4 where that matters.
- UUIDs are identifiers. Do not use them as passwords or secret tokens.
How to use
- Set the length (4 to 128, 16 by default) with the number box or the slider, and enter how many passwords you want in the "Number of passwords (1–50)" box (5 by default). A new list is generated whenever you change an option; if a value is out of range or the character settings cannot be used, a message says what to change instead.
- Under "Characters", choose which sets to use and, if needed, edit the "Symbol set". Turn on "Exclude look-alike characters (I l 1 O 0 o)" if the password will be read out or typed from paper.
- Check the estimated entropy and the strength label, then press "Copy" next to a password, or "Copy all" to copy the whole list with one password per line. "Regenerate" makes a new list with the same settings.
- For IDs, go to "UUID generator", choose v4 or v7 under "Version", enter the number of UUIDs (1 to 100, 5 by default), turn on "Uppercase", "Without hyphens" or both if your system expects that form, and press "Generate UUIDs". Changing the version or either check box makes a new list of different UUIDs rather than reformatting the current ones. The "Copy all" button next to "Generate UUIDs" copies the list with one UUID per line.
- To check an existing UUID, paste it into the "Paste a UUID" box under "UUID inspector"; the result updates as you type. The UUID is accepted with or without hyphens, in upper or lower case, in curly braces or with a urn:uuid: prefix. The result says whether it is valid and shows the normalized form (lower case with hyphens), the variant, the version and, where the UUID stores one, its timestamp; for the nil and max UUIDs it shows the type instead of the variant and version.
Frequently asked questions
How random are the passwords, and is it safe to copy them?
Each character is picked with crypto.getRandomValues, the cryptographically secure random number generator built into your browser, using rejection sampling to avoid the bias of a simple remainder operation; the characters are then shuffled. The list exists only in the open page and is replaced when you reload the page, press "Regenerate" or change an option. A copied password stays on the clipboard until something else replaces it, and clipboard history or sync features may keep a copy or pass it to your other devices, so after pasting it into your password manager, copy something else and remove the entry from any clipboard history.
What do Weak, Fair, Strong and Very strong mean, and how long should a password be?
They are bands of the estimated entropy: below 40 bits is Weak, 40 to below 60 Fair, 60 to below 80 Strong, and 80 bits or more Very strong. Each character adds log2 of the number of possible characters, about 6.4 bits with the default 85 (all four sets with the default symbols), so the default length of 16 gives about 102.6 bits, which is Very strong. For a random password kept in a password manager, a length in the Very strong band is a sensible target if the site accepts it. If a site allows only letters and digits, make up for the missing symbols with length: 20 characters from those 62 give about 119 bits.
Why can the real strength be lower than the estimate?
With "Include at least one character from each selected set" turned on, passwords that miss a set are not generated, and when the password has more characters than there are selected sets, the remaining ones are not all equally likely. The true entropy is therefore lower than length × log2(number of possible characters) suggests. The difference is noticeable for short passwords but small for long ones: 4 characters from the four default sets show about 25.6 bits, while the exact figure is about 21.8 bits; at the default 16 characters the gap is less than half a bit. With that option turned off, each character is drawn independently from all the possible characters, and the estimate matches how the passwords are generated.
A website rejects some of the symbols. What should I do?
Delete the symbols the site does not accept from the "Symbol set" box, or type in only the ones it allows; the list is regenerated as you type. Spaces are ignored and a character entered twice counts once. If the site requires a symbol, keep "Include at least one character from each selected set" turned on. If it accepts no symbols, clear the "Symbols" check box and increase the length to make up for the smaller set of characters.
Should I use UUID v4 or v7?
Use v4 when order does not matter or when the creation time should not be readable from the ID. A v7 UUID begins with a 48-bit Unix timestamp in milliseconds, and apart from the version and variant bits the remaining 74 bits are random, although some generators use part of them for a counter or a finer time. As a result, v7 UUIDs sort roughly by creation time, and as database keys this often keeps new entries close together in an index. On this page, the first v7 UUID in each millisecond gets 73 random bits, with the top bit of the 74 left at 0. When more v7 UUIDs are made in the same millisecond, or the device clock goes back, the previous value is raised by a random amount instead of drawn again, so they still come out in order.
Can two generated UUIDs be the same?
In theory yes, but in practice the chance is negligible as long as the browser's random number generator works as intended. A v4 UUID has 122 random bits, so about 2.7 × 10^18 of them would have to be generated for a 50% chance that any two are equal. Each v7 UUID made on this page is larger than the one before, so they do not repeat while the page stays open, and a v7 UUID made elsewhere could only match one of them if it had the same millisecond and the same random bits.
Why does the inspector show a timestamp for some UUIDs and not for others?
It reads a time only from versions 1, 6 and 7 of the RFC 9562 variant, which store one in a defined place: versions 1 and 6 count 100-nanosecond intervals since 15 October 1582, and version 7 counts milliseconds since 1970-01-01 UTC. The time is shown in UTC to the millisecond. It comes from the clock of the device that created the UUID, and some generators shift or round it, so treat it as an approximate creation time. Version 2 replaces part of the timestamp with other data, version 8 has a layout defined by whoever made it, and versions 3, 4 and 5 contain no time.