Free Random String Generator - Secure Strings, Passphrases & Format Presets

Character mode builds strings from a configurable alphabet (uppercase, lowercase, digits, symbols, or a custom set) at any length up to 2048 characters — ideal for API keys, tokens, and secrets. Passphrase mode assembles random dictionary words with a separator of your choice, optionally appending a number or symbol, producing strings that are both high-entropy and memorable. Presets give you one-click access to eight correctly-formatted outputs — UUID v4, 128/256-bit Hex, API Key with sk_live_ prefix, JWT Secret in Base64URL encoding, Alphanumeric, 4-digit PIN, and 6-digit PIN — each displaying its entropy rating upfront.

The entropy badge shows the theoretical strength of your configuration in bits (e.g. "~128 bits entropy"). It is calculated as length × log₂(alphabet size). Higher is stronger: 64 bits is generally considered weak today, 128 bits is solid for most applications, and 256 bits is overkill-strong. The badge updates live as you change the character set or length so you can tune settings before generating.

Every string is generated with crypto.getRandomValues() — the browser's OS-backed entropy source — not Math.random(), which is a deterministic pseudo-random function with predictable sequences. crypto.getRandomValues() draws from hardware noise, interrupt timing, and other non-deterministic system events, producing outputs that are computationally infeasible to predict or reproduce.

When generating a batch of strings, No Duplicates guarantees that every string in the output is unique. This is important when you need a set of API keys, invite codes, or session tokens where repeated values would cause collisions. The generator uses a Set internally and retries until the batch is filled with unique strings.

API keys: 32–40 Base62 characters (~190 bits) is standard. JWT secrets: 32+ bytes in Base64URL (the JWT Secret preset gives 256 bits). Session tokens: 128-bit hex minimum (32 hex chars). Webhook secrets: 32–64 hex or alphanumeric characters. PIN codes: 4-digit for low-security, 6-digit for better security. The entropy badge helps you choose — aim for 128 bits minimum for production use.

Yes. After any generation, a Download button appears in the output header. Clicking it saves all generated strings as a plain UTF-8 text file (random-strings.txt), one string per line. Useful for batch provisioning API keys, seeding a database with test IDs, or handing credentials to a team without copy-paste errors.

Never. All generation runs entirely in your browser. No string, key, secret, or passphrase is sent to any server, logged to analytics, or persisted in any way. The page works offline after the first load, making it safe for generating credentials in air-gapped or restricted environments.