Skip to content

Random String Generator

In-browser only Web Crypto API
Ctrl+Enter Generate

Quick Presets

Entropy: 191 bits / string
Characters
Overrides the character toggles above when non-empty. Emoji and accented letters count as one character each.
Output format
Related tools View all

Overview

Crypto-secure random strings, generated in your browser

Cryptographically secure random strings generated entirely in your browser using the Web Crypto API. No data is ever transmitted or stored.

  • Cryptographically secure via Web Crypto API (crypto.getRandomValues)
  • Five built-in presets: API Key, Token, Hex Token, Password, PIN
  • Configurable length (1-1024), count (1-100), and character sets
  • Raw text, or Hex / Base64 / Base64-URL encodings of truly random bytes
  • Custom character sets, including emoji and accented letters
  • Exclude ambiguous characters to reduce transcription errors
  • Real-time entropy estimate in bits per string
  • All generation runs entirely in your browser — nothing is transmitted
  • Uses crypto.getRandomValues() with rejection sampling to eliminate modulo bias
  • Math.random() is never used
  • Closing the tab discards all generated strings and session history
  • Use at least 32 characters for API keys and session tokens
  • API keys and client secrets for services and webhooks
  • Session tokens and CSRF protection tokens
  • Password-reset and email-verification tokens
  • Database seed data and test fixtures
  • PINs, coupon codes, and invite codes

How to Generate Secure Random Strings

How to Generate Secure Random Strings

  1. 1
    Choose a preset or configure manually

    Select a preset (API Key, Token, Hex Token, Password, PIN) for instant configuration, or adjust length, character sets, and output format manually.

  2. 2
    Set your character requirements

    Toggle uppercase, lowercase, digits, and special characters on or off. Enable "Exclude ambiguous" to remove look-alike characters (0, O, o, 1, l, I). Enter a custom character set to override the toggles entirely.

  3. 3
    Pick an output format

    Choose Raw for strings built from your character set. Hex, Base64 and Base64-URL instead encode the chosen number of random bytes — use them for hex secrets, HTTP headers, or URL-safe tokens and JWT secrets.

  4. 4
    Generate and copy

    Click Generate (or press Ctrl/Cmd+Enter) to produce a batch. Copy individual strings with the row copy button, copy all at once, or download as a .txt file.

Output format comparison

Output format comparison

Format Example Output length Characters Use when
Raw mK7#Rq2vLp9nXe4s… = configured length From active charset General-purpose tokens, passwords
Hex a3f8c2d1b04e7f9a… 2 × bytes 0–9, a–f Hex secrets, checksums
Base64 o/jC0Z5L+eRwBq1Y… ⌈4/3 × bytes⌉ A–Z, a–z, 0–9, +, /, = HTTP headers, JSON payloads
Base64-URL o_jC0Z5L-eRwBq1Y… ⌈4/3 × bytes⌉, no padding A–Z, a–z, 0–9, -, _ URL params, JWT secrets

For Hex, Base64 and Base64-URL, the length setting is the number of random bytes: 32 bytes give 64 hex characters, 44 Base64 characters or 43 Base64-URL characters (256 bits).

Frequently Asked Questions

Is this random string generator cryptographically secure?
Yes. All strings are generated using crypto.getRandomValues() from the Web Crypto API with rejection sampling to eliminate modulo bias. Math.random() is never used.
What is the difference between Base64 and Base64-URL output formats?
Standard Base64 uses +, /, and = characters. Base64-URL replaces + with -, / with _, and removes padding (=), making the output safe for use in URLs, HTTP headers, and JWT tokens without percent-encoding.
What does "Exclude ambiguous characters" do?
It removes characters that look visually similar: 0 (zero), O (capital o), o (lowercase o), 1 (one), l (lowercase L), and I (capital i). This reduces transcription errors when strings need to be read and typed manually.
How does the custom character set option work?
When you enter characters in the custom character set field, those characters replace the standard character toggles entirely. Each visible character counts once — emoji and accented letters are never split. Duplicates and spaces are removed automatically, and the "Exclude ambiguous" filter still applies. The custom set is used by the Raw format; Hex and Base64 always encode random bytes.
How is entropy calculated?
For Raw strings, entropy (in bits) = length × log₂(character set size): a 32-character string from 62 characters (upper + lower + digits) has about 190 bits. For Hex and Base64, every random byte adds 8 bits, so 32 bytes give 256 bits. Higher entropy means the string is harder to guess or brute-force.
Are my generated strings stored anywhere?
No. All generation happens locally in your browser using JavaScript. Nothing is uploaded, stored, or transmitted to any server. Closing the tab discards all generated strings and session history.
What is the maximum length I can generate?
You can generate strings up to 1024 characters long (or 1024 random bytes for Hex and Base64), in batches of up to 100 strings at a time.