Random String Generator
A random string generator creates unpredictable sequences of characters using cryptographically secure randomness. This tool uses the browser's built-in Web Crypto API (`crypto.getRandomValues`) to produce strings that are statistically uniform and suitable for security-sensitive applications such as tokens, API keys, session identifiers, and nonces.
You can customise the character pool by toggling uppercase letters (A-Z), lowercase letters (a-z), digits (0-9), and symbols. The length can range from 1 to 128 characters, and you can generate up to 50 strings at once. Each string guarantees at least one character from every selected set, and the result is shuffled with the Fisher-Yates algorithm to eliminate positional bias.
How it works
Uses `crypto.getRandomValues(Uint32Array)` to draw indices into a character pool built from the selected sets. Each character position is independently and uniformly sampled, then the array is shuffled with a crypto-secure Fisher-Yates pass: swap(i, randomInt(0..i)) for i from n-1 down to 1.
Use cases
- Generating secure API keys and access tokens for web services
- Creating random session IDs or CSRF tokens in web applications
- Producing test data with random identifiers for development and QA
- Generating one-time passwords (OTPs) or verification codes
- Creating random filenames or temporary directory names to avoid collisions
Frequently asked questions
How does a random string generator work?
The tool builds a character pool from the sets you enable (uppercase, lowercase, digits, symbols) and draws each position independently using the browser's Web Crypto API (crypto.getRandomValues), which produces statistically uniform values. The result is then shuffled with a crypto-secure Fisher-Yates pass so no character set is stuck in a predictable position.
Is this random string generator cryptographically secure?
Yes. It relies on crypto.getRandomValues rather than Math.random, so the output is suitable for security-sensitive uses like API keys, session identifiers, CSRF tokens, and nonces. Math.random is not designed for security and should never be used for secrets.
How long should a random string be for a secure token?
It depends on the threat model, but longer strings with larger character pools are exponentially harder to guess, since each extra character multiplies the number of possible combinations by the pool size. Enabling all four character sets and using a generous length gives the most entropy; this tool supports lengths from 1 up to 128 characters.
Does every generated string include characters from all selected sets?
Yes. Each string is guaranteed to contain at least one character from every set you selected, so a string with digits and symbols enabled will never come out as letters only. The final Fisher-Yates shuffle ensures those guaranteed characters do not always appear at the start.
Are my generated strings sent to a server?
No. Generation happens entirely in your browser using the Web Crypto API, and nothing is transmitted or stored anywhere. This makes the tool safe to use even for real secrets like API keys and passwords.