Random String Generator
Generate random strings with the length and character set you choose, from your browser's cryptographic random source. The entropy in bits is shown so you can judge whether a string is actually strong enough for what you are using it for.
How it works
Entropy is the number that matters
Length alone tells you little. What matters is entropy: log2(pool size) × length, in bits. Each bit doubles the work an attacker must do.
Rough guidance: below 64 bits is weak against a determined offline attack. 80 bits is a reasonable floor for a session token. 128 bits is the standard target for anything long-lived — an API key, a password-reset token, a secret. A 22-character string from a 62-character alphabet gives about 131 bits.
Why cryptographic randomness is required
Math.random() is a fast pseudo-random generator, not a secure one: its output is predictable from a few observed values, and it is seeded weakly. Anything used as a secret must come from a cryptographically secure source — crypto.getRandomValues() in the browser, secrets in Python, crypto/rand in Go.
This tool uses crypto.getRandomValues(). It also avoids modulo bias in how it maps random values onto the character pool only approximately — see the note below.
The look-alike option
Excluding 0, O, 1, l and I makes a string safe to read aloud or copy by hand, at the cost of a little entropy. Use it for anything a human will transcribe — a device pairing code, a recovery code printed on paper — and leave it off for machine-only secrets, where you want the full alphabet.
What people use it for
- Generating a secret for a local development config or an environment variable.
- Creating a test fixture that needs unpredictable values.
- Producing a one-off token for a script or a webhook.
- Making a human-readable code with look-alike characters excluded.
- Filling a password field where you will store the result in a password manager.
Nothing is uploaded. This tool runs entirely in JavaScript in your browser. Your input is never sent to a server, never logged and never stored, and no account is required. Once the page has loaded you can go offline and it still works — open your browser's network tab and watch if you'd like to confirm it.
Frequently asked questions
Is this secure enough for a production secret?
The randomness is cryptographically secure and nothing is transmitted, so it is far better than most online generators. For production secrets, generating them on the machine that will use them is still the better habit — for example openssl rand -base64 32 or python -c "import secrets; print(secrets.token_urlsafe(32))".
How many bits of entropy do I need?
Below 64 bits is weak. Around 80 bits is a reasonable floor for a session token. 128 bits is the standard target for long-lived secrets such as API keys. The tool shows the entropy for your current settings.
Why not just use Math.random()?
It is a fast pseudo-random generator, not a secure one: its output is predictable from a few observed values. Secrets must come from a cryptographically secure source, which is what this tool uses.
Does excluding look-alike characters weaken the string?
Slightly, because the pool is smaller — the displayed entropy accounts for it. Use the option for codes a person will read or type, and leave it off for machine-only secrets.
Are the strings sent anywhere?
No. They are generated in your browser and never transmitted. A secret a server has seen is not a secret.
Tools that run where your code is
This page does its work in your browser because sending your data to a server to process it is a bad default. Catalase applies the same idea to AI coding: a free, open-source code editor that runs language models on your own machine through Ollama, with no account and no telemetry. Cloud models are there when you choose one, not by default.
Related tools
- UUID generator — Random version 4 UUIDs.
- API key generator — Prefixed keys in common formats.
- Hash generator — SHA-256 and SHA-1 digests.