Use synthetic or nonsensitive test values. No automatic drafts, ads or analytics run in this workspace.
Password generation
Choose the character groups, length and count before generating synthetic candidates. Every selected group is represented; exclusions can reduce the available alphabet.
A check to understand
Two 16-character results with all four groups selected should each have exactly 16 characters and the required group coverage.
Limits and handling
Supported length is 12–128 and batch count up to 50. This page uses browser cryptographic randomness, but clipboard history, browser extensions and downloaded text have separate retention behavior.
Troubleshooting
Select at least one character group and check length 12–128 and count 1–50. If exclusions leave an unsupported request, correct it and generate again; do not paste an existing account password.
Questions
Are the results automatically saved?
No. Generation is explicit and this workspace adds no automatic draft storage. A copied/exported result can be retained by other apps or the device.
Use synthetic or nonsensitive test values. No automatic drafts, ads or analytics run in this workspace.
Passphrase generation
Generate words from the bundled 7,776-word list with browser cryptographic randomness. Choose the supported word count and inspect the separator and final result.
A check to understand
A six-word selection produces six dictionary words; word count is different from character count.
Limits and handling
Supported phrases have 6–12 words. No strength guarantee is made for a phrase that you edit, reuse or transmit elsewhere.
Troubleshooting
Choose 6–12 words. A character count is not a word count; the full list is sampled independently and repeated words are allowed.
Questions
Do separators add selection entropy?
No. The independently selected words provide the stated selection space. A fixed separator does not add random choices.
Wordlist: Electronic Frontier Foundation, EFF Large Wordlist (2016). The numbered source was converted to a bundled array with all 7,776 words retained. Attribution and license evidence. No EFF endorsement is implied.
Use synthetic or nonsensitive test values. No automatic drafts, ads or analytics run in this workspace.
Hash and HMAC checks
Select the digest or HMAC operation and enter text using its stated encoding. HMAC additionally uses a key; an unkeyed digest is not message authentication.
A check to understand
SHA-256 of UTF-8 text abc is ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad.
Limits and handling
The supported input budget is measured in UTF-8 bytes, up to 100,000, with a separate 1,024-byte HMAC key budget. MD5 supports legacy checksum compatibility; it is unsuitable for collision-resistant security decisions.
Troubleshooting
Select digest or HMAC explicitly. HMAC requires a nonempty supported key/algorithm; check the UTF8 byte budgets rather than just visible character count.
Questions
Does a digest encrypt or hide the message?
No. A digest is unkeyed; HMAC authenticates with a key. Neither is encryption, and an ordinary SHA digest is not a password-storage function.
Use synthetic or nonsensitive test values. No automatic drafts, ads or analytics run in this workspace.
bcrypt verification and generation
Verify an existing supported bcrypt hash or generate a hash at an offered cost. A verification result concerns the supplied text and hash, not an account login.
A check to understand
The public compatibility test string U*U verifies against its recorded bcrypt test vector; this is test data, not a password suggestion.
Limits and handling
Input must occupy 1–72 UTF-8 bytes; truncation is rejected. Generation supports costs 10–12 and verification accepts the supported hash forms at costs 4–12. Higher cost increases local work; cancel/reset invalidates pending results.
Troubleshooting
Check 1–72 UTF-8 bytes, the chosen action and the supported hash/cost syntax. A long input is rejected instead of silently truncated; reduce the cost/input if a bounded operation stops.
Questions
Does bcrypt verification recover a password or sign into an account?
No. It compares the supplied synthetic text against the supplied supported hash. It neither recovers a password nor contacts an account service.
Keep the boundary clear
The pinned worker performs the selected operation in this browser. No automatic input storage, network request, advertising or analytics is enabled here. Changing tools resets the previous form and output. Clipboard history, extensions and the device remain outside this control.
A path on the same site is not an independent browser origin. This security workspace is enabled only at https://webtoolsforall.com/workspace/private/. It shares the public site’s origin. Ads and analytics remain disabled across this site; this path is not independent origin isolation.
Review before use
Generated passwords and passphrases use the worker’s secure randomness and supported length limits. A digest does not encrypt a document; HMAC needs the intended key and algorithm. bcrypt verification compares an input with a supported stored hash; it does not recover a password.