Is the randomness cryptographically secure?

Yes. Generation uses crypto.getRandomValues, the browser's CSPRNG, so the output is suitable for tokens, passwords, and test secrets.

Can I supply my own character set?

Yes. Pick from lowercase, uppercase, digits, and symbols, or paste a fully custom charset. Duplicate characters are weighted naturally.

Are generated strings stored anywhere?

No. They exist only in your browser tab and disappear when you close it. Nothing is logged or transmitted.

crypto.getRandomValues · 1-1024 chars · 1-100 strings

Generate cryptographic random strings

Uses Web Crypto for true randomness. Mix character sets, exclude lookalikes, batch up to 100 at once.

Random String Generator

Length

per string

Count

strings

Alphabet

chars

Entropy/str

95 bit

≈

input · alphabet preview

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789

output · random strings

Click Generate to create random strings

Quick Start

How to generate random strings

Uses crypto.getRandomValues() — the same source used for keys and tokens. Output is unpredictable and uniform.

01
Pick length
1-1024 chars. 16 is plenty for passwords; 32+ for tokens.
Tokenisation is Unicode-aware via \p{L}\p{N} property classes — so accented letters, ideographs, and emoji code points all count correctly.
lengthUTF-8Unicodecode pointslive
len · text16 · UTF-8
```
16 chars
```
loaded · UTF-8UTF-8 · ready
02
Pick charsets
Mix a-z, A-Z, 0-9, symbols. More charsets = more entropy per char.
Live re-counts run on every keystroke through a memoised reducer, so even multi-megabyte inputs stay smooth in the editor.
alphalivememoisedoptionssnappy
sets · options62 · live
```
a-z + A-Z + 0-9
```
options applied · livelive
03
Exclude lookalikes
Common excludes: 0/O/I/l/1. Useful for human-readable codes.
Output preserves the original line endings (\n vs \r\n) and trailing whitespace is reported separately so you can spot diff-only changes.
filterline endingswhitespacediff-cleanreproducible
block · counted0OIl · ready
```
no 0OIl
```
counted · livecounted
04
Generate batch
Up to 100 strings at once. Click Copy on any row or Copy all for newline-joined.
Copy writes via the Async Clipboard API; downloads ship as text/plain; charset=utf-8 — nothing leaves your tab.
batchclipboardtext/plainblobclient-side
✓ · copiedready · done
```
✓ 5 strings
```
shipped · ready to shipsuccess

Pro tips

Text-processing fundamentals worth knowing

Tokenise with Unicode classes

Use \p{L}\p{N} with the u flag so accents, ideographs, and emoji count properly.

Normalise line endings

Convert \r\n to \n before diffing or hashing — Windows-vs-Unix endings produce phantom changes.

Mind invisible characters

Zero-width joiners, BOMs, and non-breaking spaces look identical to ASCII space. Strip them before comparison or storage.

Stream don’t slurp

For multi-megabyte text, iterate line-by-line rather than loading everything to memory — keeps the tab responsive.

Choose collation deliberately

Default JS sort is code-point order, not human alphabetical. Use Intl.Collator for locale-aware sorting.

Re-run after normalisation

NFC vs NFD changes byte length but not visible glyphs. String.prototype.normalize() before counts and comparisons.

Use Cases

When to generate random strings

Tokens, IDs, fixtures.

API tokens

Stub auth headers or webhook secrets. Tokenisation uses Unicode property classes (\p{L}, \p{N}) with the u flag so accents, ideographs, and emoji code points all count correctly. Surrogate-pair-aware counts mean 🚀 weighs 1, not 2.

Unicode-correct

Test fixtures

Seed databases with realistic identifiers. Result updates as you type — paste and watch totals settle in milliseconds even on multi-megabyte inputs. Heavy work runs through a memoised reducer so the editor never janks.

diff-clean

Promo codes

Batch generate unique codes for campaigns. Output normalises line endings to LF for clean diffs across platforms. Windows-vs-Unix CRLF mismatches disappear, which keeps git blame honest and review comments focused on real changes.

instant counts

Slug suffixes

Disambiguate filenames or short URLs. Code-point counts are stable across NFC/NFD normalisation. Pair with the Reading Time Calculator to layer scan-time on top of raw counts, useful for editorial budgets and SEO meta-description limits.

platform-aware

Tokens & nonces

CSRF tokens, session IDs, salts. All processing runs client-side — paste sensitive or pre-publish copy without it leaving the tab. The clipboard API writes UTF-8 text/plain so it survives transit to any editor or CMS.

code-point-accurate

Game seeds

Repeatable random seeds for procedural games. Same input plus same options always produces identical output, so the tool is safe to embed in CI scripts or doc-generation pipelines without race conditions.

lossless

FAQ

Frequently asked questions

Is this cryptographically secure?

Yes — uses Web Crypto's getRandomValues, which uses the OS CSPRNG.

Max length?

1024 chars per string. 100 strings per batch.

Modular bias?

Yes — strings include a slight bias on alphabets that aren't powers of 2. For most use cases (≤256) it's negligible.

Excluded chars?

Custom list. Useful to drop visually-confusing ones like 0/O/I/l/1.

Is anything sent to a server?

No. Generation runs entirely in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!