Updated: September 17, 2026
My password generators seeded PCG32 with a 64-bit random number, then let parseInt round it to a double. A 64-character secret key held about 53 bits. Still random, just not as random as I said. read on »
Updated: September 17, 2026
Generate API keys in a format worth shipping: an identifying prefix, a random base62 body, a CRC32 checksum, and the SHA-256 hash your server should store instead of the key. read on »
Updated: September 17, 2026
Hash a password with bcrypt at the cost and prefix you choose, or check a password against an existing hash, all in your browser. Includes the 72-byte limit, cost tuning and code for Python, Node, PHP and Go. read on »
Updated: September 17, 2026
A Django SECRET_KEY in Django's exact format, with the settings.py and .env lines, quoting advice for $ and #, check --deploy rules and SECRET_KEY_FALLBACKS rotation. read on »
Updated: September 17, 2026
Random AES keys, Fernet keys, hex strings and GCM nonces generated in your browser, plus keys vs passwords, AES-GCM, key storage, rotation and envelope encryption. read on »
Updated: September 17, 2026
Generate a username and password line for HTTP Basic auth using bcrypt, apr1 MD5 or SHA-1, with matching htpasswd commands and nginx, Apache and Caddy config. Every format was tested against the real servers. read on »
Updated: September 17, 2026
Generate a random HMAC secret sized to RFC 7518 for HS256, HS384 or HS512, plus how PyJWT, jsonwebtoken and jose actually read it and how to rotate it with kid. read on »
Updated: September 17, 2026
Build passwords you can remember and type, like Word-Word-Word-Word-42!, that still pass website rules, with honest entropy for the exact pattern. read on »
Updated: September 17, 2026
Generate a safe RCON password and the exact server.properties lines, then learn why vanilla Minecraft has no join password and how the whitelist, online mode and a private RCON port fit together. read on »
Updated: September 17, 2026
Generate a random MongoDB user password with the percent-encoded version for connection strings, plus ready db.createUser() and db.changeUserPassword() commands. read on »
Updated: September 17, 2026
Generate truly random PINs of 4, 6, 8 or any length from 3 to 12 digits, with an optional filter that skips repeated digits, straight runs and the most common PINs. read on »
Updated: September 17, 2026
Generate a long random Redis password with ready requirepass, CONFIG SET and ACL SETUSER commands, a zero-downtime rotation step, and an encoded redis:// URL. read on »
Updated: September 17, 2026
Strong Roblox password ideas for kids, teens and parents: three random words plus two digits, or random characters, with plain advice on 2-Step Verification, parent accounts and scams. read on »
Updated: September 17, 2026
One generator for every framework secret: Flask and Django SECRET_KEY, Laravel APP_KEY, Auth.js AUTH_SECRET, Rails secret_key_base and WordPress salts, with the exact line to paste. read on »
Updated: September 17, 2026
Generate SQL Server passwords guaranteed to meet the CHECK_POLICY complexity rules, with escaped CREATE LOGIN and ALTER LOGIN T-SQL, connection strings and MSSQL_SA_PASSWORD for Docker. read on »
Updated: September 17, 2026
Make a random Steam password in your browser, then learn the Steam-specific stuff: Steam Guard, 15 day trade holds, the accidentally reported scam, and checking your Web API key. read on »
Updated: September 17, 2026
Make up to 1,000 UUID v4 or v7 values at once in standard, uppercase, no-hyphen, GUID or URN format, and decode any UUID to see its version and timestamp. read on »
Updated: September 17, 2026
Generate a WPA2 or WPA3 Wi-Fi passphrase (random, easy to type on a TV, or words) and a QR code guests can scan to join, all in your browser. read on »
Updated: September 17, 2026
AI makes it easy to ship code fast-and to paste secrets into the wrong place even faster. This post is a blunt tour of the boring security habits that keep working: password managers and MFA, real secret handling (not "temporary" hardcodes), least-privilege access, and a simple rule for LLMs: treat prompts like support tickets and sanitize before you paste. read on »
Updated: September 17, 2026
Dev-facing AI tools don't need to be "evil" to be dangerous. The real risk is the plumbing: plugins, MCP servers, and CI bots wired to powerful tokens that nobody audits. This post lays out the boring rules that actually prevent leaks-read-only by default, tight scopes, dev/prod separation, human review for writes, and short policies engineers will follow. One pasted config or one sloppy token is all it takes. read on »
