~/tools/crypto/random-string
Random String Generator
random-string-generator
No string generated yet
How it works
This generator draws bytes from the Web Crypto API, specifically crypto.getRandomValues(), which browsers implement on top of a cryptographically secure pseudorandom number generator (CSPRNG). Generation happens entirely in your browser: the string is never sent to a server, and you can inspect the source of this page to see exactly how it is produced.
Why not Math.random()
Math.random() is fast but predictable. It is not designed to resist guessing, and in some JavaScript engines its internal state can be reconstructed from observed outputs, which then reveals every value it will ever produce. Anything used as a secret, token, or key needs a CSPRNG instead.
Entropy and length
Each character drawn from a set of N possible characters carries log2(N) bits of entropy. A 32-character string from a 62-character alphabet (a-z, A-Z, 0-9) carries about 190 bits, far more than the 122 random bits in a UUIDv4. Longer strings and larger character sets both increase entropy. For a fixed length, adding the symbols set adds much less than adding uppercase to lowercase did, because the printable symbol range is small.
Modulo bias
Mapping raw bytes onto a character set with a simple modulo would skew the result: 256 possible byte values do not divide evenly by, say, 62 characters, so the first few characters of the set would appear slightly more often than the rest. This tool uses rejection sampling instead: byte values at the top of the range are discarded, so every character stays exactly equally likely.
When to use it
Good uses: API keys, database tokens, identifier prefixes, verification codes, and test fixtures. For passwords, longer is better; a mixed set at 20 characters or more is a reasonable floor. If a system rejects special characters, uncheck the symbols set rather than shortening the string.
Treat anything this tool produces as a secret. Copy it straight into your password manager or config, and avoid pasting it into sites or tools you do not control. If you need raw bytes (for hashing or key material), prefer hex or base64 encoding over a mixed-case string.