Password Generator
Secure memorable passwords.
Settings
Cryptographic generation with window.crypto.
Your new password
This page does NOT send your password to any server. Generation uses window.crypto.getRandomValues, the same API professional password managers rely on.
How this tool works
A strong password is your first line of defense against brute-force attacks and credential leaks. This generator produces cryptographically random keys using the browser's window.crypto.getRandomValues API — nothing is ever sent to a server.
We recommend at least 16 characters mixing uppercase, lowercase, digits and symbols. That combination jumps from 10⁹ possibilities to over 10²⁸, making dictionary attacks impractical.
How to use it, step by step
- 1
Pick a length
16 characters is today's reasonable minimum. 20+ for critical accounts (banking, main email).
- 2
Toggle character sets
Uppercase + lowercase + digits + symbols. If a site rejects any symbol, disable it here.
- 3
One-click copy
The Copy button uses the browser clipboard. Paste it into your manager (1Password, Bitwarden, KeePass) right away.
- 4
Never reuse
One password per site. If one leaks, the rest stay safe.
Use cases
- Bank accounts and crypto wallets
- Main and recovery email
- Admin panel access (WordPress, Vercel, AWS)
- API keys or webhook secrets (use 64+ chars)
- Public-facing social accounts
Common pitfalls
- Using dictionary words or names — they fall in seconds.
- Obvious letter-to-number swaps (a→4, e→3) — crackers know the trick.
- Reusing the same password across sites.
- Storing them in a plain .txt, phone notes or unencrypted browser sync.
Frequently asked questions
- Do passwords leave my browser?
- No. Everything is generated in-browser via window.crypto.getRandomValues. Zona Utility never sees your password.
- How many characters are enough?
- 16 is the minimum today. 20+ for banking and email. 32+ if you'll use it as an API key or seed.
- Can I get a memorable password?
- Yes — enable passphrase mode: 4–6 random words joined with hyphens. Strong and rememberable.
- Is using this tool legal?
- Yes. Passwords are random and only visible to you. We log nothing.
- Why do some sites reject symbols?
- Legacy form-validation hangover. Disable symbols here and bump the length to compensate.