Is this actually cryptographically secure, or just Math.random()?
Cryptographically secure — every character comes from the Web Crypto API's crypto.getRandomValues(), with rejection sampling to avoid modulo bias, not Math.random().
Random String Generator
Configuration
Unioned with the character types above (duplicates are ignored so every character stays equally likely).
Generated strings
Generated strings will appear here.
About this Random String Generator
Generate cryptographically secure random strings with custom character sets.
Random strings are generated locally in your browser using the Web Crypto API and never sent anywhere.
FAQ
What's the difference between this and the Password Generator?
This is built for general-purpose random strings — tokens, test data, IDs, cache keys — with more character-set flexibility, including a custom-characters field. The Password Generator is tuned specifically for human-usable passwords and passphrases.
Can I exclude ambiguous characters like 0/O or l/1?
Yes — toggle Exclude ambiguous to drop easily-confused characters from the output.
How many strings can I generate at once?
Up to 50 per batch — pick 1, 5, 10, 20, or 50, each up to 256 characters long.
Can I generate a hex or Base64-style string instead of alphanumeric?
Not as a built-in preset, but the custom-characters field gets you there — type 0-9a-f for hex, or your own alphabet for anything else. It's merged with any built-in sets you also enable.
Is the generated string sent anywhere?
No — entirely client-side.
Related tools