Random String Generator
This tool creates random strings you can use as passwords, API keys, tokens or test data, generated using your browser's Web Crypto API so the output is cryptographically strong rather than predictable like a basic random number function. You set the string length from 1 to 256 characters, how many strings to generate at once (from 1 up to 50), and the character makeup, either through a preset such as alphanumeric, hex, numeric only or URL-safe, or by ticking your own combination of uppercase letters, lowercase letters, digits and symbols. You can also add extra custom characters or exclude ambiguous ones such as 0, O, 1, l and I so strings are easier to read and type correctly. Once generated, the calculator shows the entropy in bits, the alphabet size used, the number of possible combinations as a power of ten, and a strength rating running from weak through to excellent, along with a full breakdown of length, quantity, character set and generation method. Use the strength bar as your guide: aim for at least 72 bits for a general password and 128 bits or more for API keys, tokens or anything security-sensitive. Everything runs locally in your browser and nothing is sent to any server, but for production secrets and long-term cryptographic keys, generate them in a secure server-side environment rather than relying on browser output alone.
1. String Options
2. Character Sets
String Details
Strength Reference
How the Random String Generator Works
This tool uses window.crypto.getRandomValues(), the Web Crypto API built into modern browsers. This is a cryptographically strong pseudo-random number generator (CSPRNG) that produces unpredictable output suitable for security-sensitive use cases such as passwords, API keys, and session tokens. It falls back to Math.random() only if the Web Crypto API is unavailable, which is noted in the output.
The algorithm works as follows: given a character alphabet of size N and a desired string length L, it generates L random integers in the range [0, N) using rejection sampling (to avoid modulo bias) and maps each to a character in the alphabet. The entropy of each string is L x log2(N) bits.
Entropy and Why It Matters
Entropy is a measure of unpredictability, expressed in bits. Higher entropy means more possible combinations, which makes brute-force guessing harder. The formula is:
Entropy = length x log2(alphabet size)
| Use Case | Recommended Entropy | Example Settings |
|---|---|---|
| General password | 72+ bits | Length 12, all chars (94-char set) |
| High-security password | 100+ bits | Length 16, all chars |
| API key / token | 128+ bits | Length 22, alphanumeric (62-char set) |
| Session token | 128+ bits | Length 32, hex (16-char set) |
| Cryptographic key | 256 bits | Length 44, alphanumeric or length 64, hex |
Character Sets Explained
The generator supports these character groups:
- Uppercase letters (A-Z): 26 characters. Used in most passwords and tokens.
- Lowercase letters (a-z): 26 characters. Case-sensitive systems treat these as distinct from uppercase.
- Digits (0-9): 10 characters. Adds numerical variety.
- Symbols: 32 printable ASCII symbols (e.g. !@#$%^&*). Greatly increases entropy but may not be accepted by all systems.
- URL-safe mode: Uses a-z, A-Z, 0-9, hyphen, and underscore. Safe to use in URLs, filenames, and most APIs without encoding.
The exclude field lets you remove ambiguous characters (such as 0, O, 1, l, I) that can be misread when printed or typed manually.
Worked Example
Default settings: length 24, alphanumeric preset (A-Z, a-z, 0-9 = 62 characters), 1 string.
- Alphabet size: 62
- Entropy: 24 x log2(62) = 24 x 5.954 = 142.9 bits
- Strength: Excellent (128+ bits) -- suitable for API keys and tokens
- Possible combinations: 62^24 = approximately 10^43.0
A string of this type with 142.9 bits of entropy would take longer than the age of the universe to brute-force on current hardware.
Related Calculators
- Essential Calculators: full collection of digital and utility tools.
- Hash Generator (MD5, SHA): generate MD5, SHA-1, SHA-256 hashes from any text.
- Base64 Encoder / Decoder: encode and decode Base64 strings online.
- Password Strength Checker: check how strong your password is.
- Bandwidth Calculator: calculate data transfer times and bandwidth requirements.
Method: String entropy calculated as L x log2(N) where L = string length and N = alphabet size. Random values generated using window.crypto.getRandomValues() with rejection sampling to eliminate modulo bias. Strength thresholds based on NIST SP 800-63B guidance and general security practice.
This tool generates strings in your browser only. No strings are transmitted to any server. For production security use, always generate cryptographic secrets in a secure server-side environment using a trusted library. Do not use browser-generated strings as long-term cryptographic keys without additional key derivation.