Random String Generator — how and why to generate secure tokens, passwords and keys
A random string generator is a tool for creating character sequences from a specified set (alphabet, digits, special characters) of desired length. Such strings are used in software development, testing, information security, and system administration. Our generator operates based on the cryptographically secure crypto.getRandomValues() algorithm, built into every modern browser.
Cryptographic security: why it matters
Not all random number generators are equal. The ordinary Math.random() in JavaScript is pseudo-random and predictable — it is not suitable for generating passwords, tokens, or encryption keys. The crypto.getRandomValues() method belongs to the CSPRNG (Cryptographically Secure Pseudo-Random Number Generator) class and uses the operating system's entropy source. This same method is used in TLS/SSL, Web Crypto API, JWT token generation, and other critical systems. Our generator uses exclusively crypto API, ensuring maximum strength of generated strings.
Password generation: length, entropy, strength
A strong password has sufficient entropy — a measure of unpredictability. Entropy is calculated as the string length multiplied by the logarithm of the alphabet size in base 2. For a password from the set a-z, A-Z, 0-9 (62 characters), each character adds ~5.95 bits of entropy. A 12-character password has ~71 bits, 16-character — ~95 bits, 20-character — ~119 bits. NIST recommendations (SP 800-63B) require a minimum of 8 characters for online services, but modern practice is 14-20 characters with mixed sets.
Authorization tokens and API keys
Tokens (access token, refresh token, API key) are secret strings confirming access rights to a resource. For API keys, the standard length is 32-64 alphanumeric characters, providing 190-380 bits of entropy. Session identifiers (session ID) must have at least 128 bits of entropy according to OWASP recommendations. CSRF tokens, nonce values, and one-time confirmation codes are also generated using CSPRNG.
UUID v4: universally unique identifier
UUID v4 (RFC 4122) is a 128-bit identifier where 122 bits are random, and 6 bits are reserved for version and variant. Format: xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx, where y is one of 8, 9, a, b. UUID v4 provides 2^122 (~5.3 × 10^36) possible values, making collision probability negligibly small even when generating billions of identifiers. UUID is widely used as a primary key in PostgreSQL, MongoDB, microservice architectures, and distributed systems.
HEX and Base64: encoding formats
HEX (hexadecimal encoding) represents each byte with two characters (0-9, a-f). Used for hashes (SHA-256 = 64 HEX characters), MAC addresses, CSS colors (#FF5733), and encryption keys. Base64 encodes three bytes with four characters from the alphabet A-Z, a-z, 0-9, +, / (and = for padding). Applied for encoding JWT, embedding images in HTML (data URI), transmitting binary data in JSON and XML.
Salt and password hashing
Salt is a random string added to the password before hashing to protect against rainbow tables and brute force attacks. Each user should have a unique salt. The recommended salt length is at least 16 bytes (32 HEX characters or 22 Base64 characters). Modern hashing algorithms (bcrypt, Argon2, scrypt) generate salt automatically, but for other scenarios — for example, HMAC or encryption — salt must be generated separately.
Test data for development
Random strings are indispensable in testing: filling form fields, creating mock data, load testing, validation and length constraint verification. The generator allows you to quickly create a thousand strings of the required length with any character set — and download them as a text file for import into a test database or script.
Security tips when working with secret strings
Generated passwords, keys, and tokens should be stored in a password manager (1Password, Bitwarden, KeePass) or in a secure secrets vault (HashiCorp Vault, AWS Secrets Manager, GCP Secret Manager). Never store secrets in plain text in code, configs, or repository (git). To transfer secrets between team members, use encrypted channels or one-time links (e.g., OneTimeSecret). Key and token rotation is mandatory practice: change API keys and service tokens at least every 90 days.