🗄️ Database Password Generator
Connection-safe passwords for MySQL, Postgres, Mongo & Ghost configs. Skips characters that break connection strings, env files & shell commands.
🔒 Generated in your browser, never sent anywhere. Excludes @ : / \ ' " ` ; $ { } & # so it won't break connection URIs or env vars.
Most password generators throw every symbol they can find at you. Great for a login form, terrible for a database. Paste one of those into a connection string and you'll spend the next twenty minutes wondering why your app won't boot, when the real culprit is a stray @ or / that broke the URI.
This tool fixes that. It generates passwords that are still long and random, but only uses characters that are safe to drop straight into a DATABASE_URL, a .env file, or a docker-compose.yml without escaping anything.
Why database passwords are different
A normal password is typed by a human into a login box. A database password is read by a machine out of a config file or a connection string. That difference matters more than people think.
Connection strings follow a strict format:
postgres://username:password@host:5432/dbname
See the problem? The : separates the user from the password, the @ separates the password from the host, and the / marks the database name. If your password contains any of those characters, the parser gets confused and your connection silently fails or, worse, points somewhere unexpected.
The same goes for .env files (where quotes and $ cause trouble), YAML configs, and shell commands where `, ;, and & can do real damage if they're interpreted instead of read literally.
What this generator does differently
It only uses characters from a connection-safe set:
- Letters: A to Z, a to z
- Numbers: 0 to 9
- Safe symbols:
- _ . ~ + = *
Those symbols are explicitly allowed in URIs and play nicely inside quotes, so nothing breaks. The characters that cause problems (@ : / \ ' " \ ; $ { } & #`) are left out entirely.
You still get plenty of entropy. A 24-character password from this set has roughly 140 bits of strength, which is far beyond anything a brute-force attack will ever crack.
Features
- Adjustable length from 12 to 64 characters
- Toggle character sets on and off (letters, numbers, safe symbols)
- Exclude look-alike characters like
O,0,l,1, andIso nobody fat-fingers a manual entry - One-click copy with a fallback for browsers that block clipboard access
- Regenerate button to spin up a fresh password instantly
- Live strength meter showing real entropy in bits
- 100% private: every password is generated locally in your browser using the cryptographically secure
crypto.getRandomValues(). Nothing is ever sent to a server, logged, or stored.
How to use it
- Pick a length. For a production database, 24 characters or more is a sensible floor.
- Leave all three character sets on unless your database has a specific restriction.
- Flip on "exclude look-alikes" if anyone will ever type this password by hand.
- Hit Generate, then Copy, and paste it into your config.
Where these passwords work
These passwords are safe to use with:
- MySQL and MariaDB
- PostgreSQL
- MongoDB connection URIs
- Redis
requirepass - Ghost CMS database config
- Docker environment variables and compose files
- Any app that reads credentials from a
.envfile
A few good habits
Use a different password for every database. Store them in a secrets manager or your hosting provider's environment variables, never hard-coded in a file you commit to Git. And rotate them whenever someone with access leaves the team.
Frequently Asked Questions
Everything you need to know about generating connection-safe database passwords.
A regular password is typed by a person, while a database password is read by software out of a connection string or config file. Characters like @, :, and / have special meaning in those strings, so a database password has to avoid them to prevent connection errors.
Almost always because it contains a reserved character. The @ symbol, for example, marks where the host begins in a URI like postgres://user:pass@host. If your password has an @ in it, the parser splits the string in the wrong place. This generator removes those characters so it can't happen.
Yes. Strength comes mostly from length, not from exotic symbols. A 24-character password from this set has around 140 bits of entropy, which would take longer than the age of the universe to brute-force. Dropping a handful of problem symbols barely changes that.
No. Everything runs locally in your browser using the built-in crypto.getRandomValues() function, the same cryptographic source recommended for security-sensitive work. The password never leaves your device, isn't logged, and isn't stored anywhere.
Twelve characters is the bare minimum. For anything facing the internet, 24 or more is the safe choice. The slider goes up to 64 if you want maximum headroom.
Yes. The character set is safe across all major databases and their connection-string formats, plus tools like Docker, Redis, and Ghost CMS.
It removes characters that are easy to confuse: capital O and zero, lowercase L, the number one, and capital I. Turn it on when someone might have to read or type the password manually, so they don't mix up an l for a 1.
Store it in a secrets manager or your host's environment variables. Never commit it to a Git repository, and use a unique password for every database so one leak doesn't compromise the rest.
