Password Generator — Safe for Filenames, URLs, WhatsApp & Shells

Name: Password Generator
Availability: InStock
Author: ZTools

Generate 56-character passwords that survive filenames, database URLs, terminals, spreadsheets and chat apps. 30 service presets. Runs offline in your browser.

About Password Generator

A transport-safe password generator creates random passwords that cannot be corrupted by the systems they pass through on the way to the login field. Most generators ignore this: a password containing `*` or `_` is silently reformatted by WhatsApp, Telegram and Slack; one containing `@` or `#` breaks a `postgres://user:PASS@host` connection string; one containing `<` or `?` cannot be used as a Windows filename; and one starting with `=` or `+` is executed as a formula when pasted into Excel. The ZTools Password Generator removes those characters by construction, then re-checks the finished password against each hazard and shows a live pass/fail chip for every one. It uses the browser's `crypto.getRandomValues()` CSPRNG with rejection sampling (no modulo bias) and a Fisher–Yates shuffle. Nothing is transmitted; the page works offline once loaded.

Use cases

A database password that will not break the connection string. Supabase, Neon, Railway and most hosted Postgres providers build a `postgres://user:PASS@host/db` URI from your password without URL-encoding it. A password containing `@`, `#`, `/` or `?` makes that URI unparseable — the documented symptom is a Prisma P1001 or a DNS failure where part of the password is read as the hostname. Pick the Supabase or Database preset and the output contains only RFC 3986 unreserved characters, so it drops in unencoded.
Sending a credential over WhatsApp or Slack without it arriving wrong. WhatsApp turns `*text*` bold, `_text_` italic, `~text~` struck through and backticks monospace — the markers are consumed and never appear in the message. A recipient copying what they see gets a different string than you sent, and neither of you can tell why the login fails. The chat-safe option removes every formatting character, so what is sent is what arrives.
Naming an encrypted archive or key file after its password. Windows rejects `< > : " / \ | ? *` anywhere in a filename and refuses a name ending in a dot or space; macOS and Linux reject `/`; and the names CON, PRN, AUX and NUL are reserved on Windows regardless of extension. The filename-safe option enforces all of these, including the reserved-name check, so the password can be used as a file or folder name on any operating system.
Getting the longest password a specific service will accept. Google accepts up to 100 characters, Microsoft Entra ID up to 256, AWS IAM up to 128, and a consumer Microsoft account only 16. Pick the service and the generator targets its ceiling minus a small safety margin — because stated maximums are often off by one and some forms truncate silently rather than rejecting. Every preset shows whether its limit is documented by the vendor, merely widely reported, or a conservative default we chose because nobody publishes one.
Storing a secret in a .env file, YAML config or CSV export. dotenv splits on `=`, treats `#` as a comment and interpolates `$VAR`. YAML gives `:` and `#` structural meaning. A CSV cell beginning with `=`, `+`, `-` or `@` is executed as a formula by Excel and Google Sheets — a real injection vector, not a cosmetic issue. Each of these is a separate toggle, so a password destined for a config file is generated to fit it.

How it works

Pick where the password has to work. Choose a service preset (Google, Apple, AWS, Supabase, Wi-Fi and more) or a general-purpose profile. The preset sets the length and the transports the password must survive.
The alphabet is narrowed to what survives. Each selected transport removes the characters that break it. Selecting all of them leaves letters and digits — 62 characters. The panel shows the live alphabet size and bits per character as you toggle.
The password is drawn. `crypto.getRandomValues()` with rejection sampling, so there is no modulo bias from a naive `% n`. The first and last characters come from a further-restricted set, so the password never starts with a character a shell reads as a flag or a spreadsheet reads as a formula.
Structural rules are enforced. No run of three identical characters, no Windows reserved device name, and none of the sequences editors silently rewrite — `--` into an em dash, `(c)` into ©, `:)` into an emoji. A candidate that trips any rule is discarded and redrawn.
The result is audited, not assumed. The finished string is re-checked against every hazard and each one gets a green or red chip. A red chip names the exact offending character. This reads the password itself, so the display cannot drift from reality.
Copy, or generate up to 50 at once. Bulk mode produces distinct passwords for seeding service accounts, and downloads as a plain .txt file. Everything stays in the browser.

Examples

Input: Universal safe preset, 56 characters
Output: N.S7HcDd2J21aA9TgG.Yi%QhTt-rbDs@ew4G+Z@PDrybqw1%eWtZZQhs
Letters, digits and the five transport-safe symbols - . @ % + — about 339 bits. Safe as a filename, in a terminal, in a spreadsheet cell and in a chat message at once, and it satisfies a site that demands a special character.

Input: Supabase database password preset
Output: lFdY19vYCqk4-vK3V0jbGOiapVZv.keeqQKUjVBS3TtDOpkRvHpCZCTMltlV
RFC 3986 unreserved characters only — the symbols narrow to - and . — so encodeURIComponent() returns it unchanged and it drops into postgres://user:PASS@host with no percent-encoding.

Input: Microsoft account preset (16-character ceiling)
Output: JACe6SJ2HcEda%5
15 characters — the reported 16-character cap minus a one-character margin — with an upper, a lower, a digit and a symbol all guaranteed, which is what its sign-up form requires.

Frequently asked questions

Which symbols does it use, and why only those?

Five: - . @ % + — worked out character by character against each transport. Every other printable symbol is destroyed by something common: * _ ~ and backticks are chat formatting, < > : " / \ | ? * are illegal in a Windows filename, $ ! ; & ( ) [ ] { } are shell metacharacters, = and # break a .env file, and , ; break a CSV. At least one of the five appears in every password, because a great many sign-up forms reject a password with no special character. For a database URL only - and . qualify, since @ and % have structural meaning in a URI — the Database preset narrows to those two automatically.

Why is the default 56 characters instead of 16?

Because length is the one thing nothing can mangle. A 56-character password over this 67-character alphabet carries about 340 bits of entropy; a 16-character password using all 94 printable ASCII characters carries about 105. The long one is roughly three times stronger and it also survives filenames, URLs, shells, spreadsheets and chat apps. Length costs you nothing except a paste.

Why does my password get mangled in WhatsApp?

WhatsApp, Telegram, Slack and Discord all interpret `*` as bold, `_` as italic, `~` as strikethrough and backticks as monospace. The markers are consumed by the formatting and never appear in the delivered message, so the recipient copies a shorter, different string. The chat-safe option removes those characters entirely, which is why it is on by default.

Why does my database connection fail when the password has an @ or a #?

A connection URI has the shape `scheme://user:password@host/db`. The parser splits on `@` to find the host and on `#` to find a fragment, so a password containing either splits the URI in the wrong place — the usual symptom is a P1001 connection error or a DNS lookup for a hostname that includes part of your password. The fix is either percent-encoding the password everywhere it appears, or generating one that needs no encoding. This tool does the second.

How do you know each service's maximum password length?

Honestly: for most services we do not, because they do not publish one. Every preset carries a visible badge. "Documented" means an official vendor or standards source states the number and links to it — Google, AWS IAM, Microsoft Entra ID and the WPA protocol limit are in this category. "Reported" means it is widely and consistently reported but the vendor has never confirmed it. "Conservative" means nobody publishes a limit, so we cap at 64 characters and say so rather than inventing a figure.

Why generate slightly less than the maximum?

Stated maximums are frequently off by one, some forms trim trailing characters before validating, and some systems truncate silently rather than showing an error — which would leave you with a password shorter than the one you saved. The margin is proportional: `min(4, floor(max / 10))`, so a 100-character ceiling gives 96 while a 16-character ceiling gives 15 rather than losing a quarter of an already-small budget.

Is a very long password always better?

Up to a point. Beyond roughly 128 bits of entropy, additional length stops mattering against any brute-force attack that is physically possible. Separately, many systems hash passwords with bcrypt, which ignores everything past 72 bytes — so on those systems a 120-character password is exactly as strong as a 72-character one. Extra length is harmless, it just stops buying anything.

What does the safety checklist actually check?

It runs the generated string through the same rules the generator applied, character by character, and reports the result. It reads the password, not the settings — so if a setting and the output ever disagreed, the chip would go red and name the offending character. A green chip is evidence, not a promise. Toggle a compatibility option off and generate, and you can watch the corresponding chip fail.

Does this tool log or store my passwords?

No. There is no backend and no request is made when you generate. Open DevTools, switch to the Network tab, and press Generate — you will see nothing. The page continues working with the network disconnected once it has loaded.

Pro tips

Leave the default alone unless a service rejects it. 56 characters with a guaranteed upper, lower, digit and symbol clears almost every sign-up form and cannot be corrupted in transit.
When a site rejects a generated password, it is almost always objecting to the length rather than the characters — drop to a preset with a lower ceiling before changing anything else.
For anything going into a .env file, a YAML config or a connection string, use the Database preset even if the service allows more characters. Debugging a percent-encoding problem costs more than the few bits you give up.
Read the confidence badge before trusting a length. "Conservative" means we picked 64 because the service publishes nothing — if it rejects that, lower the length rather than assuming the preset is wrong.
Turn on "Read aloud" for a Wi-Fi password or anything you will dictate over the phone; it drops the i/l/1/L and o/O/0 look-alikes that cause transcription errors.
Use a unique password for every service and store them in a password manager. Reuse, not length, is what causes most account compromises.

Reviewed by Ahsan Mahmood · Last updated 2026-07-25 · Part of ZTools.

For the full, formatted version of this page, please enable JavaScript and reload https://ztools.zaions.com/password-generator.