Random String Generator
Generate cryptographically secure random strings. Choose a length from 1–512 and a charset: alphanumeric, hex, or symbols.
Tokens, salts, API keys, and temporary passwords all need real randomness — not Math.random(). This generator draws from your browser's cryptographically secure RNG (crypto.getRandomValues), lets you pick the length and character set, and never stores or transmits what it makes.
Uses your browser's cryptographic random number generator (crypto.getRandomValues) — suitable for tokens, salts, and temporary passwords.
How to use this calculator
- Enter the length you need (1–512).
- Pick a character set: alphanumeric, hex, or symbols.
- Click Generate, then copy the result.
Worked example
With the alphanumeric set, 16 bytes of values 0–15 map by modulo 62 to the string "ABCDEFGHIJKLMNOP" — verified by running the generator function. In real use the bytes come from your browser's secure RNG, so every output is unpredictable.
Frequently Asked Questions
What makes these strings secure?
They're drawn from crypto.getRandomValues(), your browser's cryptographically secure pseudorandom number generator — the same entropy source behind TLS keys and crypto.randomUUID(). That makes them unpredictable. Math.random(), by contrast, is deterministic and must never be used for anything security-sensitive.
Which character set should I choose?
Alphanumeric (62 characters) is the best all-rounder for tokens and IDs — compact and URL-safe. Hex (16 characters) matches what APIs, hashes, and keys conventionally use. Symbols adds punctuation for maximum entropy per character, which is what you want for passwords where every character counts.
How long should my string be?
For a temporary token or generated password, 32 alphanumeric characters carry about 190 bits of entropy — far beyond brute force. API keys are conventionally 32–64 characters. Longer only helps meaningfully up to about 256 bits of entropy; beyond that you're just making strings harder to handle.
Can I use this for passwords?
For generated passwords, reset tokens, and secrets your password manager stores — yes. For a master password you must memorize and type, a passphrase of random words beats 32 random characters, because humans can't reliably transcribe those.
Does the page remember the strings it generates?
No. Generation happens locally in your browser and nothing is stored, logged, or transmitted. Copy your string right away — refreshing the page loses it permanently.