Skip to content

Security

Random String Generator

Generate cryptographically secure random strings for tokens, IDs, and keys — with full control over length and character sets.

≈ 191 bits of entropy (pool of 62 symbols)

Generated with crypto.getRandomValues and rejection sampling — safe for real tokens and keys. Nothing is transmitted.

Length Beats Complexity for Real-World Strength

Entropy grows with length and pool size, but length wins in practice: a 16-character lowercase-only string carries more entropy than an 8-character one with every symbol class. For identifiers, favor unambiguous characters (no 0/O, 1/l/I) and a prefix that says what the ID is for — future-you reading a log will thank present-you. For anything secret, the same rule as every generator applies: it must come from crypto.getRandomValues(), not a general-purpose random function.

How the Strings Are Generated

  1. Set the string length and enable/disable character sets: lowercase, uppercase, digits, and symbols.
  2. A hex-only mode produces clean identifiers for database keys.
  3. Generation uses crypto.getRandomValues with rejection sampling — no modulo bias.
  4. Generate in bulk (up to 100 strings) and copy all with one click.
Formula & Technical Standard
Entropy = length × log2(pool size) bits — shown live so you can pick a length that meets your security policy.

Example Output

API-style secret key
Input: 32 chars, all sets
Output: e.g. "Kp9#vX2mQ…’ — 209 bits of entropy
32 characters over a 90-symbol pool exceeds the entropy of most real-world secret requirements.
Clean hex IDs
Input: 16 chars, hex mode
Output: e.g. "a3f9c2e81b7d4065"
Hex strings avoid shell-escaping issues and are the conventional format for database identifiers.

Common Questions

Is this safe for security tokens?

Yes — the browser crypto API is the same source of randomness used for the site’s password generator, suitable for real secrets.

Are the generated strings transmitted anywhere?

No. Generation and display are entirely local; nothing is logged or sent.