Random String Generator
This tool generates random strings using your browser's built-in cryptographical
This tool generates random strings using your browser's built-in cryptographical
How to use Random String Generator
- Set the length and how many strings you want, then choose which character sets to include.
- Optionally exclude look-alike characters, require one from each set, or paste a custom character set.
- Click Generate, then copy a single string, copy all, or download them as a .txt file.
About Random String Generator
This tool generates random strings using your browser's built-in cryptographically secure random number generator (the WebCrypto API), not JavaScript's ordinary Math.random(). It uses rejection sampling so every character in the pool is equally likely, with no modulo bias — the same approach you'd want for passwords, API keys, tokens, test data, or unique identifiers.
You control the length, how many strings to produce at once, and which character sets to include: uppercase, lowercase, digits, and symbols. You can exclude look-alike characters (i, l, 1, L, o, 0, O) for strings people have to read or type, require at least one character from each selected set, or paste your own custom character set to override everything else. The tool also shows a rough entropy estimate (log2 of the pool size times the length) so you can gauge how hard a string would be to guess.
Everything runs locally in your browser. No string is ever uploaded, logged, or sent to a server, and there's no account or sign-up. You can copy any single string, copy all of them at once, or download the whole batch as a plain .txt file.
Frequently asked questions
- Are these random strings safe to use for passwords or API keys?
- Yes. They come from the WebCrypto CSPRNG (crypto.getRandomValues), which is designed for security-sensitive use, and the tool samples without modulo bias so each character is equally likely. For a strong secret, use a good length (16+ characters) and include several character sets — the entropy readout helps you judge.
- Is anything I generate sent to a server?
- No. All generation happens in your browser using local JavaScript and WebCrypto. Nothing is uploaded, stored, or transmitted, and there is no sign-up. You can even use it offline once the page has loaded.
- What does the 'exclude look-alikes' option do?
- It removes characters that are easy to confuse when read or typed — lowercase i and L, the number 1, capital L and O, lowercase o, and the number 0. Turn it on for codes people have to copy by hand; leave it off to keep the full character pool and maximum entropy.
- How does the custom character set work?
- Anything you type into the custom field replaces the checkbox options entirely. Duplicate characters are collapsed, and the string is built only from the unique characters you provided — handy for hex (0-9A-F), a specific alphabet, or excluding particular symbols.
- What does the 'at least one from each set' option mean?
- When on, every generated string is guaranteed to contain at least one character from each set you selected (for example, one uppercase, one digit, and one symbol). This is useful for password rules that require character variety. The length must be at least as large as the number of selected sets.
- How many strings can I generate at once?
- Up to 500 strings per batch, each up to 4096 characters long. Use 'Copy all' to grab them as newline-separated text, or 'Download .txt' to save the whole batch as a file.