Random String Generator

A random string generator produces character sequences you can use as passwords, API keys, session tokens, or one-off identifiers — anywhere you need a value that's unpredictable and hard to guess. The quality of that unpredictability depends entirely on the source of randomness behind it: a generator built on a weak or predictable random number source can produce strings that look random but aren't, which defeats the purpose for anything security-related.

This tool draws its randomness from `crypto.getRandomValues`, the Web Crypto API's cryptographically secure random number generator, and uses rejection sampling when mapping random bytes to characters. That second detail matters more than it sounds: a naive implementation that does `randomByte % charsetLength` introduces a subtle bias toward characters near the start of the character set, which very slightly weakens the output. Rejection sampling discards out-of-range bytes instead of reducing them modulo the charset size, so every character in your chosen set stays exactly equally likely.

Everything runs locally in your browser — the random bytes never leave your device, and the generated strings are never transmitted, logged, or stored anywhere. That's an important property for a password or token generator specifically: a tool that generates your secrets server-side is a tool that could, in principle, see them. Because it's fully client-side, this generator also keeps working with no internet connection once the page has loaded.

You control the character composition with four independent toggles — uppercase letters, lowercase letters, numbers, and symbols — so you can match whatever a target system requires or forbids (some legacy systems reject certain symbols, for instance). Length can be set up to 256 characters, and you can generate up to 100 strings in a single batch, which is convenient for seeding test accounts, generating a batch of API keys, or producing a set of one-time codes.

As a rule of thumb for passwords: longer and more varied is stronger. A 16+ character string drawing from all four character types is a reasonable default for most services; increase the length further for anything protecting high-value access. Once generated, copy the list directly, or use the “Send to” button to hand a value straight to another tool in this toolbox — for instance, to check its length or compute a hash of it.