What is a random string generator used for?
Random strings are used wherever you need unpredictable, hard-to-guess values: API keys, session tokens, password reset links, CSRF tokens, test data, and temporary filenames. The difference between a cryptographically random generator and a plain Math.random() call is enormous — crypto.getRandomValues draws from the operating system's entropy source, making the output indistinguishable from random even under adversarial analysis. This tool uses that API for every string it produces.
How to use this tool
- 1 Set the length and how many strings you want.
- 2 Select the character sets — uppercase, lowercase, digits, and/or symbols — or type a custom set.
- 3 Choose a separator (newline, comma, space, pipe) for the output.
- 4 Hit the regenerate button to produce a fresh batch without changing settings.
Frequently asked questions
Is this truly random or pseudo-random?
It uses crypto.getRandomValues, which is cryptographically secure pseudo-random (CSPRNG). It draws from OS-level entropy and is suitable for generating tokens, API keys, and passwords — unlike Math.random(), which is not.
What is the maximum length?
Up to 512 characters per string, and up to 100 strings per batch. If you need more, run multiple batches.
Can I use a custom character set?
Yes. Type any characters in the "Custom characters" field and they completely override the checkboxes. Repeated characters increase the probability of those characters appearing.
Is there any bias in character selection?
The tool uses rejection sampling: each random 32-bit value is mapped to a character by taking the value modulo the charset length. This introduces a tiny modulo bias that is negligible for sets larger than 2 characters — the bias is less than 1 in 42 million for a 26-character set.
Is my output sent anywhere?
No. Generation runs entirely in your browser with no server involvement.