Tool
Database password generator
A random password of letters, digits, and only four symbols - - _ . , - the ones that never need escaping anywhere. It never needs escaping in a SQL string, an unquoted shell word, a .env file, a YAML value or a URL, because there is no quote, backslash, space or shell metacharacter in it, and it never starts with a symbol either. Made in your browser, and never sent or saved anywhere.
Nothing you enter here is sent or saved. Privacy policy
How strong is it?
- Strength
- -
- Randomness
- -
- Time to guess
- -
- Length
- -
Time to guess assumes an attacker who knows exactly how the password was made and tries ten billion guesses a second, taking on average half the possibilities. Sites and databases that store passwords properly are far tougher than that.
Where this is safe to paste, unquoted
The characters are A-Z, a-z, 0-9 and only - _ . , (never as the first character), so the result can go straight into any of these with no quoting, escaping or lookup table of "characters this tool doesn't like":
-- SQL: no quote inside the string to close early
CREATE USER 'app'@'%' IDENTIFIED BY 'Xk3m_Pq.7-q,2...';
# Shell: no space, $, *, ;, | or leading - to misread as a flag
export DATABASE_URL="postgres://app:Xk3m_Pq.7-q,2...@db:5432/app"
# .env file: no quote needed at all
DB_PASSWORD=Xk3m_Pq.7-q,2...A password with more symbols than this can still be made safe with careful quoting, but careful quoting is exactly the kind of thing that goes wrong under time pressure, in a script, or in a config format that quotes differently to the one you tested in. Sticking to symbols that are always safe, everywhere, means there is nothing to get wrong.
Using it well
One per account. Reusing a password is the fastest way to turn one leak into many, including for service accounts.
This is for machines, not for memorising. If a person needs to type and remember it, the passphrase generator is the better tool - it is built to the ACSC/ISM guidance for exactly that case.
Mind the clipboard. Copying puts the password where clipboard managers can hold on to it. Pasting straight into a secrets manager or your `.env` file is safest.
Nothing leaves this page. The password is made from your browser's secure random number generator, and the site blocks any request that isn't to itself. Open your browser's network tab and watch nothing happen.