Random String Generator
Cryptographically secure random strings for test data, tokens and IDs. Generated in your browser, so nothing you make is ever uploaded.
- Free
- No sign-in
- Nothing leaves your device
- Works offline
In 3 steps
How to use it
Choose a style
Letters, numbers, symbols, hex, base64url, or your own characters.
Set length and count
See the strength in bits update as you change the length.
Copy
Copy one string or the whole list. Nothing is stored.
Fast facts
Good to know
-
Entropy, in plain sight
We show the bits of randomness, so you know how hard a string is to guess.
-
Browser-grade crypto
Built on crypto.getRandomValues, the same source browsers use for secure connections.
-
No bias
Rejection sampling means every character is exactly equally likely.
-
No lookalikes
One switch removes 0/O and 1/l/I so codes are easy to read aloud.
FAQ
Random String Generator: your questions answered
Is this random string generator secure?
Yes for tokens, IDs, test data and codes. Every character is chosen with your browser’s cryptographically secure generator (crypto.getRandomValues) using unbiased rejection sampling, and strings are created on your device and never sent anywhere.
Should I use it to create passwords?
The strings are strong enough to be passwords, but the best approach is a password manager, which creates, stores and fills them for you so you never have to copy and paste secrets around. Use this page for tokens, API keys, IDs and test data.
What is entropy and how many bits do I need?
Entropy is a measure of how unpredictable a string is: each bit doubles the number of guesses an attacker needs. 128 bits is a common target for secret tokens. For example, 32 hex characters is 128 bits, and 22 base64url characters is 132 bits.
What is the difference between hex and base64url?
Hex uses 16 characters (0–9, a–f), so each character adds 4 bits. Base64url uses 64 URL-safe characters (A–Z, a–z, 0–9, - and _), so each adds 6 bits and the string is shorter for the same strength.
Are the strings stored or logged?
No. They exist only on your screen. We have no server code that could receive them, and the page is blocked by your browser from sending data to any other site.
Private by design. No accounts, no cookies, no tracking. Everything you generate stays on your device.
How we keep it that wayReady? Press the button.
Free, fast and private. No sign-in, ever.