Web Crypto Security Random Numbers

Random String random string generator

Customize character rules to safely generate up to 1,000 groups at a time, and provide entropy estimation and complete export.

Output format

General string character pool

0Available characters
0 bitsEstimate Entropy per group
0Number of results so far

produce results

Download format

Secure random strings and Entropy

This tool uses a browser crypto.getRandomValues() Obtain the cryptographically secure random numbers provided by the operating system, and then use rejection sampling to avoid deviations caused by simple modulation. It is suitable for creating test identification codes, temporary Tokens, Nonces, file names and unpredictable strings; if used in a formal authentication system, it still needs to cooperate with the server-side life cycle, hash storage and permission control.

The theoretical entropy value of a general repeatable pattern is approximately 長度 × log₂(字元池大小). When unique characters are enabled, the number of possible combinations decreases with each draw, so the tool estimates based on the number of characters that can be selected one at a time. Entropy measures the space of possibilities and does not mean that a string is necessarily safe in a specific system.

How to choose the format?

  • General strings: Fine control of capitalization, numbers, symbols and custom characters.
  • URL Safe: Use only alphanumeric characters, hyphens, and underscores that fit within the URL fragment.
  • Hex: Contains only 0–9 and a–f, suitable for color, hash fragments, or low-level data representation.
  • Alphanumeric characters: Avoid symbols causing escape problems in forms or command lines.

Frequently Asked Questions

Do you use Math.random()?
No. All character indexes are generated by the Web Crypto API and use rejection sampling to reduce distribution skew.
Is Entropy a password strength guarantee?
No. It is an estimate of the theoretical possibility, and actual security also depends on the storage method, usage, leakage risk and attack model.
Why is there a limit to the length of unique characters?
Each character can only be used once, so the length cannot exceed the deduplicated character pool size.
Can URL Safe be used directly as a URL?
The characters should fit within the URL path or query value, but the full URL should still be correctly encoded according to the element it contains.
How many groups can be produced at most at one time?
Maximum 1000 groups at a time to avoid extreme input that makes the page unresponsive.