Random string generator
Generate secure random strings, passwords and tokens from 4 to 512 characters: letters and digits, symbols, hex or digits only. Uses crypto.getRandomValues.
About Random string generator
The random string generator creates eight strings at a time from your browser’s cryptographically secure random source. Set a length between 4 and 512 characters and choose a character set: letters and digits, letters and digits with symbols, lowercase hexadecimal, or digits only. Select Generate for a fresh batch.
Characters are picked with crypto.getRandomValues and rejection sampling, which discards random bytes that would make some characters slightly more likely than others. Every character in the set has an equal chance at every position, so the strength of a string is predictable: its length multiplied by the bits per character.
How to use Random string generator
- Enter the length you need, from 4 to 512 characters.
- Choose Letters & digits, With symbols, Hex or Digits.
- Select Generate to create a new set of eight strings.
- Copy the string you need, or download the list as a .txt file.
Features
- Generates eight independent strings per batch, each 4 to 512 characters long.
- Letters & digits uses A–Z, a–z and 0–9: 62 characters, about 5.95 bits each.
- With symbols adds 23 symbols such as ! @ # $ % and brackets: 85 characters, about 6.4 bits each.
- Hex uses 0–9 and a–f (4 bits each); Digits uses 0–9 only (about 3.3 bits each).
- Uses crypto.getRandomValues with unbiased selection, never Math.random.
Common uses
- Creating a strong password for a new account or a password manager entry.
- Generating API keys, webhook secrets or signing secrets for development.
- Producing hex secrets for configuration values, such as a 64-character key.
- Creating random test data, coupon codes or one-time identifiers.
Tips
- For a secret key, aim for at least 128 bits: about 22 characters from Letters & digits, 32 hex characters or 39 digits.
- A With symbols string is not guaranteed to contain a symbol. If a site requires one, pick another of the eight strings that does.
Frequently asked questions
How long should a random password be?
For an account password stored in a password manager, 16 to 20 characters with symbols is plenty, giving more than 100 bits of entropy. For API keys and signing secrets, aim for at least 128 bits, such as 22 letters and digits or 32 hex characters.
Is this random enough for passwords and keys?
Yes. Strings come from crypto.getRandomValues, the browser’s cryptographically secure generator, and characters are chosen without modulo bias. That is the same quality of randomness web applications use for keys and tokens.
What is modulo bias?
A random byte has 256 possible values. Mapping it to a 62-character set with a remainder makes the first 8 characters slightly more likely, because 256 is not a multiple of 62. This tool discards bytes above the largest multiple and draws again, so every character is equally likely.
Which symbols does With symbols use?
It adds 23 symbols: ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . ?. Quotes, backslashes, spaces and angle brackets are left out because they often need escaping in shells, JSON, URLs and config files.
Why are eight strings generated at once?
Several options let you skip a string a site rejects, for example one without a required symbol, or take a few values at once for a batch of keys. Each string is generated independently, so using more than one does not weaken any of them.
Is my input uploaded?
Tools run in your browser. Files, text and results are not uploaded to our servers and are cleared when you leave the tool.
Your privacy comes first
Tools run in your browser. Files, text and results are not uploaded to our servers and are cleared when you leave the tool.