A long, random password that is unique for each service is the simplest defense against brute-force attacks on WinBox, SSH, API, or your email. This generator creates it in your browser and immediately checks it against the breached password databases on Have I Been Pwned: the password it suggests does not appear in any known data breach.
Your new password
Generated in your browser using the cryptographic random generator (crypto.getRandomValues): uppercase, lowercase, digits, and symbols, excluding characters that have special meaning in the RouterOS terminal ($ ? ; \ " '). It does not pass through any server.
Where do I keep it? Do not store it in plain text in an Excel sheet, Notepad, an email, or a sticky note: anyone who accesses your PC will find it immediately. Use a password manager, which keeps it encrypted and fills it in for you. A good, free, open-source option is Bitwarden: I am not affiliated with them, choose the one you prefer.
Verification: Pwned Passwords by Have I Been Pwned (Troy Hunt), license CC BY 4.0. Only the first 5 characters of the SHA-1 hash of the generated password are sent to them.
How is it generated?
It uses the browser’s cryptographic random number generator (crypto.getRandomValues), the same one used for encryption keys: every character is chosen uniformly, with no predictable patterns. The password always contains uppercase letters, lowercase letters, digits, and symbols. It does not pass through any server: the page does not send it to me and does not log it.
It excludes characters that are easily confused visually (I and l, O and 0) and those that have special meaning in the RouterOS terminal: $ (variables), ? (help), ; (command separator), \, and quotation marks. This allows you to paste it into a /user set command without surprises.
How does it know if it has not already been stolen?
As soon as the password is ready, the browser calculates its SHA-1 hash and sends only the first 5 characters of that hash to Have I Been Pwned; the comparison with breached hashes happens on your device (this is called k-anonymity). With 20 or more random characters, finding it in the databases is practically impossible, but the check confirms it. If you want to check a password you are already using, see the page Has your password been stolen?.
How long should it be?
At least 20 characters: with this generator, that provides approximately 120 bits of entropy, which is beyond the reach of any brute-force attack. You can extend the slider up to 64 for passwords you never type manually, such as those saved in a password manager or shared VPN keys.
Where do I save it?
Not in plain text: no Excel sheets, Notepad, emails, or sticky notes. Use a password manager, which keeps it encrypted, syncs it across devices, and fills it in for you. A valid, free, and open-source option is Bitwarden: I am not affiliated with them, so choose the one you prefer. For the router, in addition to the password, follow the how-to Basic MikroTik router hardening.
Frequently asked questions
Is the generated password saved anywhere?
No. It exists only in the page open in your browser: once you close the page, it is gone. Only 5 characters of its hash are sent to Have I Been Pwned, from which the original password cannot be derived.
Can I use it as a password for a MikroTik router?
Yes: the characters are specifically chosen to work in the RouterOS terminal, WinBox, and WebFig. Remember to also change the admin user and to close management services to the Internet.
Is it free?
Yes, like the other tools in the Tools section, and you do not need to be a dojo member.