Random String & ID Generator
Generate secure random strings, NanoIDs and ULIDs in your browser.
- Runs in your browser
- Nothing is uploaded
- Free, no sign-up
About 143 bits of entropy from 62 possible characters. Strong enough for long-lived secrets and signing keys.
About this tool
Generate random strings for tokens, API keys, test data and identifiers, with the alphabet and length you choose, or produce NanoIDs and ULIDs. Every value comes from your browser's cryptographic random source and is never sent anywhere.
How to use it
- Choose a random string, a NanoID or a ULID.
- For a random string, pick the characters and length. The entropy is shown underneath.
- Set how many you want, then copy the list or download it.
Where the randomness comes from
Values are drawn from crypto.getRandomValues(), the same cryptographically secure generator a browser uses for its own encryption keys. It is not Math.random(), whose output is predictable once a few values are seen and which should never be used to make a secret.
Mapping random bytes onto an alphabet needs care. Taking each byte modulo the alphabet size makes some characters slightly more likely than others, whenever 256 does not divide evenly. This tool discards the few bytes that would cause the imbalance, so every character is equally likely.
How long should it be?
Strength is measured in bits of entropy: the length multiplied by the base-2 logarithm of the alphabet size.
| Value | Entropy |
|---|---|
| 8 letters and digits | about 48 bits |
| 16 letters and digits | about 95 bits |
| 32 hex characters | 128 bits |
| 21 characters, NanoID alphabet | about 126 bits |
| 24 letters and digits | about 143 bits |
OWASP's guidance for session identifiers is at least 64 bits. For API keys and signing secrets, which live a long time and are attacked offline, 128 bits or more is the usual standard.
NanoID and ULID
NanoID is a compact, URL-safe identifier. At its default 21 characters from a 64-symbol alphabet it carries about 126 bits, which is comparable to a v4 UUID but 15 characters shorter.
ULID is a 48-bit millisecond timestamp followed by 80 random bits, in 26 characters. Because the timestamp comes first, ULIDs sort in creation order, which keeps database indexes tidy where random keys scatter writes. The cost is that a ULID reveals when it was made. If you need a standard format, see the UUID generator.
Tokens are not passwords
Random strings suit values a program handles. A password a person has to type or remember has different needs, such as being pronounceable or avoiding look-alike characters, which the password generator is built for. To store or compare a secret safely, pass it through a hash: see the hash generator.
Frequently asked questions
Are the strings generated on a server?
No. They are created in your browser and never leave it. You can confirm this in the Network tab of your developer tools.
Can two generated values be the same?
With 126 bits, a collision is not a practical concern. With short or numeric-only strings it is: ten-digit numbers will start to repeat after roughly a hundred thousand values.
Why avoid look-alike characters?
Characters like 0 and O, or 1, l and I, are easily confused when a value is read aloud or typed from a printout. Removing them costs a little entropy and saves support calls.
Is a ULID secret?
No. It contains its creation time in plain view and only 80 bits of randomness, so it is an identifier, not a credential.