Is the random string generator cryptographically secure?

This generator uses the Web Crypto API (window.crypto.getRandomValues) when available in your browser, which is a cryptographically strong pseudo-random number generator (CSPRNG) suitable for generating secure tokens, API keys, and passwords. It is significantly stronger than Math.random(), which is not suitable for security-sensitive purposes. The strings are generated entirely in your browser and no data is sent to any server.

How long should a random string be for a secure password?

For a password, a length of at least 16 characters using all character sets (uppercase, lowercase, numbers, and symbols) is recommended by most security standards including NIST SP 800-63B. A 16-character password from a 94-character set has approximately 10^31 possible combinations, making brute-force attacks impractical. For API keys and tokens used in applications, 32 characters or more is common. For session tokens, 64 characters is typical.

What is the difference between a random string and a UUID?

A UUID (Universally Unique Identifier) is a standardised 128-bit value formatted as 32 hexadecimal characters in a specific pattern (e.g. 550e8400-e29b-41d4-a716-446655440000). A random string is more flexible: you can choose its length, character set, and format. UUIDs are used when you need a standardised identifier format. Random strings are used when you need a custom-length key, token, or code. For most password and API key use cases, a random string is more appropriate as you can control its entropy precisely.

Random String Generator

This tool creates random strings you can use as passwords, API keys, tokens or test data, generated using your browser's Web Crypto API so the output is cryptographically strong rather than predictable like a basic random number function. You set the string length from 1 to 256 characters, how many strings to generate at once (from 1 up to 50), and the character makeup, either through a preset such as alphanumeric, hex, numeric only or URL-safe, or by ticking your own combination of uppercase letters, lowercase letters, digits and symbols. You can also add extra custom characters or exclude ambiguous ones such as 0, O, 1, l and I so strings are easier to read and type correctly. Once generated, the calculator shows the entropy in bits, the alphabet size used, the number of possible combinations as a power of ten, and a strength rating running from weak through to excellent, along with a full breakdown of length, quantity, character set and generation method. Use the strength bar as your guide: aim for at least 72 bits for a general password and 128 bits or more for API keys, tokens or anything security-sensitive. Everything runs locally in your browser and nothing is sent to any server, but for production secrets and long-term cryptographic keys, generate them in a secure server-side environment rather than relying on browser output alone.

Calculate.co.nz is proud to be partnered with Premium Homes, a recognised leader in eco-friendly, sustainable, and energy-efficient homebuilding. With a dedicated team and award-winning experience, they create homes that prioritise health, comfort, and long-term performance. Their founders, Andrew and Kelly, set out to raise the standard of residential construction in New Zealand by combining practical building expertise with a clear commitment to doing things better for homeowners.

Cryptographically Strong Uses Web Crypto API (window.crypto.getRandomValues). No data sent to any server.

1. String Options

String length (1 to 256 characters)

Number of strings to generate

Format / preset

2. Character Sets

Include character groups (used when preset is Custom) Uppercase letters (A-Z) - 26 chars Lowercase letters (a-z) - 26 chars Digits (0-9) - 10 chars Symbols (!@#$%^&*...) - 32 chars

Custom extra characters to include (optional)

Characters to exclude (optional, e.g. 0O1lI)

Generated Strings

Entropy
-
Bits per string

Alphabet Size

Unique characters

Possible Combinations

10^x combinations

Strength

Result

Click Generate to create strings.

String Details

Length-

Quantity-

Character set-

Alphabet size-

Entropy per string-

Generation method-

Strength Reference

Weak (below 40 bits)Not recommended

Fair (40-71 bits)Short-term / low risk

Good (72-111 bits)Suitable for passwords

Strong (112-127 bits)API keys, tokens

Excellent (128+ bits)Cryptographic use

How the Random String Generator Works

This tool uses window.crypto.getRandomValues(), the Web Crypto API built into modern browsers. This is a cryptographically strong pseudo-random number generator (CSPRNG) that produces unpredictable output suitable for security-sensitive use cases such as passwords, API keys, and session tokens. It falls back to Math.random() only if the Web Crypto API is unavailable, which is noted in the output.

The algorithm works as follows: given a character alphabet of size N and a desired string length L, it generates L random integers in the range [0, N) using rejection sampling (to avoid modulo bias) and maps each to a character in the alphabet. The entropy of each string is L x log2(N) bits.

Entropy and Why It Matters

Entropy is a measure of unpredictability, expressed in bits. Higher entropy means more possible combinations, which makes brute-force guessing harder. The formula is:

Entropy = length x log2(alphabet size)

Use Case	Recommended Entropy	Example Settings
General password	72+ bits	Length 12, all chars (94-char set)
High-security password	100+ bits	Length 16, all chars
API key / token	128+ bits	Length 22, alphanumeric (62-char set)
Session token	128+ bits	Length 32, hex (16-char set)
Cryptographic key	256 bits	Length 44, alphanumeric or length 64, hex

Character Sets Explained

The generator supports these character groups:

Uppercase letters (A-Z): 26 characters. Used in most passwords and tokens.
Lowercase letters (a-z): 26 characters. Case-sensitive systems treat these as distinct from uppercase.
Digits (0-9): 10 characters. Adds numerical variety.
Symbols: 32 printable ASCII symbols (e.g. !@#$%^&*). Greatly increases entropy but may not be accepted by all systems.
URL-safe mode: Uses a-z, A-Z, 0-9, hyphen, and underscore. Safe to use in URLs, filenames, and most APIs without encoding.

The exclude field lets you remove ambiguous characters (such as 0, O, 1, l, I) that can be misread when printed or typed manually.

Worked Example

Default settings: length 24, alphanumeric preset (A-Z, a-z, 0-9 = 62 characters), 1 string.

Alphabet size: 62
Entropy: 24 x log2(62) = 24 x 5.954 = 142.9 bits
Strength: Excellent (128+ bits) -- suitable for API keys and tokens
Possible combinations: 62^24 = approximately 10^43.0

A string of this type with 142.9 bits of entropy would take longer than the age of the universe to brute-force on current hardware.

Related Calculators

Essential Calculators: full collection of digital and utility tools.
Hash Generator (MD5, SHA): generate MD5, SHA-1, SHA-256 hashes from any text.
Base64 Encoder / Decoder: encode and decode Base64 strings online.
Password Strength Checker: check how strong your password is.
Bandwidth Calculator: calculate data transfer times and bandwidth requirements.

Method: String entropy calculated as L x log2(N) where L = string length and N = alphabet size. Random values generated using window.crypto.getRandomValues() with rejection sampling to eliminate modulo bias. Strength thresholds based on NIST SP 800-63B guidance and general security practice.

This tool generates strings in your browser only. No strings are transmitted to any server. For production security use, always generate cryptographic secrets in a secure server-side environment using a trusted library. Do not use browser-generated strings as long-term cryptographic keys without additional key derivation.