Generate cryptographically strong random strings, tokens, passwords, and API keys. Instant browser generation, nothing sent to a server.
This generator uses the browser's Web Crypto API (crypto.getRandomValues), a cryptographically secure random number generator built into every modern browser. Results are never sent to any server and are safe to use as tokens, API keys, session IDs, or temporary passwords.
The Plain format uses your selected character sets (uppercase, lowercase, digits, symbols). Hex outputs a lowercase hexadecimal string, useful for color codes and checksums. Base64 produces a URL-safe encoding suitable for tokens and HTTP headers. The "Exclude ambiguous" option strips characters that look alike, such as 0, O, l, I, and 1, to prevent misreading when a string is shared verbally or printed.
Uses Web Crypto API, not the predictable built-in pseudorandom function. Entropy comes from the OS itself.
Everything runs in your browser. No strings leave your device, ever.
No account, no limits, no watermarks. Generate as many strings as you need.
Choose length up to 4,096 characters, generate up to 50 strings at once, pick any format.
Use length 16 or more with all character sets enabled. Enabling symbols increases entropy significantly. Tick "Exclude ambiguous" if the password will be typed manually rather than pasted.
A 32 or 64-character alphanumeric string is standard for REST API keys. Use the Base64 format for tokens that travel in HTTP headers, as it avoids characters that need escaping.
Session tokens should be unpredictable and long enough to resist brute force. A 32-character hex string gives 128 bits of entropy, which is the recommended minimum for session identifiers.
Nonces (numbers used once) must be unique per request. A 16 to 32-character hex or Base64 string works well. Set Quantity to generate a batch for testing.
Quickly generate dummy IDs, order numbers, or unique codes for database seeding, unit tests, or mock APIs. Increase Quantity to generate up to 50 values at once.
Short 8 to 12-character alphanumeric codes work well for one-time invite links or password reset tokens. Tick "Exclude ambiguous" so users can type them without confusion.
Yes. It uses crypto.getRandomValues(), seeded by the operating system's entropy pool. This is the same source used by password managers and cryptographic libraries. It is fundamentally different from the browser's built-in pseudorandom number generator, which can be predicted if the seed is known.
For a password with uppercase, lowercase, and digits, 16 characters gives roughly 95 bits of entropy. 20 characters with symbols exceeds 128 bits, which is considered computationally infeasible to brute force with current hardware. Most security guidelines recommend a minimum of 12 to 16 characters.
Plain uses your selected character sets (letters, digits, symbols). Hex produces a string using only 0 to 9 and a to f, commonly used for checksums and cryptographic hashes. Base64 (URL-safe variant) uses letters, digits, hyphens, and underscores, making it safe for URLs, HTTP headers, and JSON. For a given length, Hex has less entropy per character than Plain or Base64.
Yes. A 32 or 64-character alphanumeric string generated here is suitable as an API key. Use Base64 format to ensure the key is URL-safe. Store API keys securely (hashed in your database, not in plaintext) and rotate them if they are ever exposed.
It removes characters that are visually similar: the digit 0 and the letter O, the lowercase l and uppercase I, and the digit 1. This matters when strings will be typed by a person rather than copied and pasted. For machine-to-machine use, leave this option off to maximise the character pool.
Entropy in bits is calculated as length multiplied by log2(charset size). A 32-character string from 62 characters (uppercase + lowercase + digits) gives roughly 190 bits of entropy. Adding symbols (94 characters total) pushes it to around 210 bits. Both are well beyond the 128-bit threshold considered secure today.
Completely. The entire generation process runs as JavaScript in your browser. Nothing you configure or generate is transmitted anywhere. There are no servers involved, no logs, and no cookies tracking your usage.