Free random string generator — API keys, tokens, IDs
Configurable length, charset, prefix, suffix, and bulk mode. Every character comes from crypto.getRandomValues — the browser's CSPRNG, the same source used for TLS session keys.
Replace this PowerShell one-liner:
-join ((65..90) + (97..122) + (48..57) | Get-Random -Count 32 | %{[char]$_})
Or this Node snippet:
require('crypto').randomBytes(32).toString('hex')
With a browser tool that runs on the same secure primitive and lets you tweak length, charset, and format without ever leaving the page.
What each mode gives you
- Alphanumeric — A-Z + a-z + 0-9. Toggles let you drop uppercase/lowercase/digits.
- Hex — 0-9 + a-f. Perfect for session tokens, HMAC keys, hash-shaped IDs.
- Base64 — A-Z + a-z + 0-9 + / + +. Compact binary token encoding.
- Base64-URL — same as Base64 but with - and _ instead of + and /. Safe in URLs.
- Alpha only — letters, no digits. For readable IDs.
- Digits only — for OTPs, PINs, numeric codes.
- URL-safe — Base64-URL without padding. Standard for JWTs and API keys.
- Custom — pass your own charset. Duplicates dropped.
Frequently asked
Is this cryptographically secure?
Yes. Every character is drawn from window.crypto.getRandomValues with rejection sampling to avoid modulo bias. Suitable for API keys, session tokens, and TLS/HMAC secrets.
How is this different from the password tool?
/password/ focuses on human-facing passwords + passphrases with an entropy meter. /random/ is for machine-facing tokens — API keys, IDs, seeds, boilerplate. Different intent, same CSPRNG under the hood.
Can I generate 1000 tokens at once?
Yes — the Count slider goes to 500 per batch. Higher batches are possible; there is no server rate limit. Copy-all and Download-as-txt bundled.
Why prefix/suffix?
Match common API-key formats (sk_live_..., pk_test_..., rk_...) or add environment tags. The random part is generated fresh each string; prefix/suffix are literal.
Do you avoid look-alike characters?
Toggle "Exclude similar" to drop 0 O 1 l I from the pool. Useful when the token will be typed by a human.
Is the output uploaded anywhere?
No. All generation is client-side. Zero POST requests. Watch the Network tab to confirm.
What is entropy in bits?
Every character contributes log₂(poolSize) bits. A 32-char alphanumeric = 32 × log₂(62) ≈ 191 bits. Above 128 bits is unbreakable by brute force with current hardware.