Is this password generator safe to use?

Yes. This generator runs entirely in your browser using the Web Crypto API (window.crypto.getRandomValues). No passwords are sent to any server, logged, or stored anywhere. You can disconnect from the internet and it still works.

How long should a database password be?

For MySQL or PostgreSQL passwords, use at least 32 characters with a mix of uppercase, lowercase, and numbers. Symbols can cause issues in some connection string formats, so test your database driver before using them. For .env files, 32-64 character alphanumeric passwords are the standard.

What makes a password strong?

Password strength comes from entropy — the number of possible combinations. A 32-character password using 72 possible characters has 72^32 combinations, making it effectively uncrackable by brute force. Length matters more than complexity: a 20-character lowercase-only password is stronger than a 10-character password with symbols.

Password Generator

Strong passwords for MySQL, SSH, .env files, and API keys. Runs entirely in your browser — nothing is ever sent to a server.

Presets

Length

4128

A–Z Uppercase a–z Lowercase 0–9 Numbers !@#$… Symbols

Exclude ambiguous (0, O, l, 1, I) No duplicate characters

Strength

Generate

Pro tips

Server credential hygiene that saves you at 3am.

🔐 Store secrets in .env, never in code

Hardcoded credentials in source code get committed to git and end up on GitHub. Always use .env files (listed in .gitignore) and reference them via environment variables. On production, set env vars at the server level rather than deploying a .env file.

🗝 Rotate database passwords after team changes

When a team member leaves, rotate all shared credentials they had access to: database passwords, API keys, hosting control panel passwords. Automated secret rotation (AWS Secrets Manager, HashiCorp Vault) makes this less painful at scale.

🔑 SSH keys beat passwords every time

For server access, use SSH key pairs instead of password auth. A 4096-bit RSA key or Ed25519 key is orders of magnitude harder to brute-force than any password. Disable SSH password auth in /etc/ssh/sshd_config: set PasswordAuthentication no.

📦 Use a password manager for server creds

Don't save server passwords in a text file or spreadsheet. Use a password manager (Bitwarden is free and open-source) with a shared vault for team credentials. It also makes rotation easier — change it in one place.

🚫 Symbols break some connection strings

Symbols like @, /, and # in database passwords can break connection string parsing in some frameworks. If you're having connection issues, try an alphanumeric-only password first to rule this out.

🔄 Different passwords per service, always

One breach shouldn't cascade. Your MySQL root password, your cPanel password, your server SSH key passphrase, and your registrar password should all be completely different. A password manager makes this practical.