Random String Generator
Generate secure random strings and passwords with control over length and character set.
A strong random string is the difference between a password that survives a dictionary attack and one that collapses in seconds. This generator creates strings from a cryptographic random source with the length and character set you choose, so the result carries real entropy rather than patterns a person or a predictable algorithm would produce.
Set the length, choose which character families to include - lowercase, uppercase, digits and symbols - and press Generate. The tool fills each position by drawing from the platform's secure random source, which is the same quality of randomness behind TLS keys. You can ask for a batch of strings at once, each with its own copy button.
This is the right tool for passwords, API keys, salt values, session tokens and any one-off secret. It is deliberately not a passphrase tool: for memorized passwords a sequence of words is easier to type and remember. For everything machine-read, a dense random string like the ones here is the strongest practical option.
L7%s2a?[7y]HPR?tU*o50;QAWyoV{DLPmN^}s{$<-q]a=-[xgCx^Jn7kVqTzk=,h]PESePM-$dViJ@+;
Features
- Choose length up to 1024 characters and generate up to 500 strings per run.
- Independent toggles for lowercase, uppercase, digits and symbols.
- Cryptographic randomness from crypto.getRandomValues, with bias-free character selection.
- Deterministic fallback: if no character family is selected, lowercase plus digits is used so output is never empty.
- Batch output with per-line copy buttons.
- Instant generation - no round trip to a server.
- Everything runs locally; generated values exist only in your tab until you copy them.
How to Use
- 1
Set the length
Pick how many characters each string should have. 16-32 is a comfortable range for a password or an API key; longer values carry more entropy.
- 2
Choose character families
Tick the sets you want in the pool. Include symbols for maximum strength, or restrict to alphanumerics when a downstream system refuses special characters.
- 3
Pick a count
Generate several values at once when you need a batch - for example a set of temporary tokens or a pile of test credentials.
- 4
Generate and copy
Press Generate for a fresh set. Each value has a Copy button, and every run draws new randomness so the set is never repeated.
Example
16-character password, all families
Length: 16 · a-z, A-Z, 0-9, symbols↓
k#7Qx!2pL$9mZv@432-character API key, alphanumeric
Length: 32 · a-z, A-Z, 0-9↓
aX9kQw3RzT8bNm7PdL2cFg5HsJ4vY6uWCommon Problems
Generating secrets with Math.random
Math.random is predictable and shared-state across the process. Secrets built from it are guessable in practice. Cryptographic randomness is the only acceptable source for passwords, tokens and keys - which is what this generator uses.
Limiting the character pool too aggressively
A 12-character password from lowercase letters only has about 61 bits of entropy. The same length with all four families has about 71 bits. Every family you drop shrinks the space an attacker must search.
Assuming length alone guarantees strength
Length matters only when the characters are drawn uniformly from the full pool. A "long" password built from a predictable pattern or a weak source is still weak.
Reusing one secret across services
A single leaked credential compromises everything it protects. Generate a distinct secret per service, and store them in a password manager rather than reusing a favourite string.
Storing secrets in plaintext
A strong random string protects against guessing, not against being stolen from a database or a config file. Store secrets hashed or encrypted where the threat model calls for it, and keep them out of source control entirely.
Technical Details
Randomness comes from crypto.getRandomValues, the platform's cryptographic random generator. The character at each position is chosen with a modulo that is kept bias-free by rejecting values in the tiny tail of the distribution.
By default the pool includes lowercase, uppercase, digits and symbols. If no family is selected, the generator falls back to lowercase plus digits so the output is never empty.
Output is a flat random string, not a passphrase. For human memory, a diceware-style passphrase is more usable; this tool targets machine-read secrets: passwords stored in a manager, API keys, salts and tokens.
Generation is on-demand and local. No value is sent anywhere, and the tool keeps no record of what it produces between sessions.
Each run is independent and draws fresh randomness, so repeated runs never produce the same set. If you need reproducibility - for tests or reproducible builds - do not use a random generator; use a deterministic derivation instead.
Frequently Asked Questions
Is this a good password generator?
For storing a strong random password in a password manager, yes - the output carries real entropy from a cryptographic source. If you need a passphrase you can memorize and type, use a word-based scheme instead; a random string of symbols is strong but hard to type on a phone.
How long should a random string be?
For passwords, 16 characters from the full pool is a solid default; 20+ gives generous margin. API keys and tokens are often 32-64 characters. Length beyond the pool's entropy is wasted - 128 characters does not meaningfully beat 32 for the same character set.
Why is Math.random not good enough?
Math.random is a pseudo-random generator with limited internal state, designed for speed, not secrecy. Given enough outputs, its state can be reconstructed, and two processes sharing a seed produce identical streams. Anything that needs to be unpredictable to an attacker must use a cryptographic source.
Can I include only letters and numbers?
Yes - untick symbols. Some systems and input forms reject or mangle special characters. The trade-off is slightly lower entropy for the same length, which you can offset by increasing the length.
Are generated strings stored or uploaded?
No. Values are generated in your browser and exist only on the page. Nothing is transmitted, and nothing survives after you close the tab.
Is a random string the same as a token?
Functionally yes. A random string is a high-entropy value with no meaning; a token is that value in a role - something a system accepts as proof of authorization. This generator produces the raw material; the system you integrate decides how the value is interpreted and stored.
Data & Privacy
Your data stays in your browser. Nothing is uploaded.
- Processing
- Local
- Upload
- None
- Server Storage
- None
- Account
- Not required
Related Tools
JWT Decoder
Inspect the header, payload and claims of a JSON Web Token - decoded locally, never uploaded.
Security & Tokens
Hash Generator
Generate MD5, SHA-1, SHA-256, SHA-384 and SHA-512 digests of any text, in your browser.
Security & Tokens
HMAC Generator
Sign a message with a secret key using HMAC-SHA256 or HMAC-SHA512, right in your browser.
Security & Tokens
UUID Generator
Generate random UUID v4 identifiers in bulk, with or without dashes, in your browser.
Security & Tokens
JWT Validator
Check a JWT's structure and time claims - signature is never verified, so the verdict is about usability, not authenticity.
Security & Tokens
Base64 Encode & Decode
Convert text to Base64 or decode it back, with an optional URL-safe mode - all in your browser.
Encoding & Conversion