QR64Code uses the browser's cryptographic randomness source. Easy mode uses readable lowercase letters and digits, balanced mode adds uppercase letters, and strong mode also adds every printable ASCII punctuation character except space. A password is generated on page load and whenever the settings change, with at least one character from every selected group.
What changed in this update?
The tool, explanation, limits, sources, and accessible form flow were reviewed together.
How to use it
- 1
Choose a password length from 8 to 64 characters; the result updates automatically.
- 2
Select the easy, balanced, or strong character pool.
- 3
Copy the result or use Generate another to create a new value with the same settings.
Limits and security notes
Acceptance depends on the destination site's length and character rules. Strong mode includes quotes, backslashes, backticks, pipes, and tildes that some legacy forms reject; use balanced mode for those sites. The eight-character option is provided for compatibility; prefer at least 15 characters for single-factor accounts whenever the service permits it.
Comparison
| Level | Characters | Best fit |
|---|---|---|
| Easy | Readable lowercase + digits | Legacy forms that reject symbols |
| Balanced | Upper/lowercase + digits | Broad account compatibility |
| Strong | Letters + digits + all ASCII punctuation | Accounts used with a password manager |
Frequently asked questions
Are passwords sent to a server?
No. Generation runs on your device through the browser's Web Crypto API; the generated password is not sent to QR64Code servers.
Is an eight-character password secure?
It is short for many modern uses. Choose at least 15–16 characters when the service permits it; a longer unique password matters more than composition alone.
Which special characters does strong mode use?
It uses the complete printable ASCII punctuation set except space, including tilde, backtick, quotes, slash, backslash, brackets, and pipe. Choose balanced mode if the destination rejects them.
How is the estimated crack time calculated?
The tool divides half of the combination space implied by the selected pool and length by a published RTX 5090 MD5 rate of 215.8 billion attempts per second. This models only an offline fast-hash attack; actual time depends on storage and attack conditions.