Random String & Token Generator
Random hex, base64, base64url, alphanumeric, digit or custom-alphabet strings from crypto.getRandomValues, grouped or prefixed, with the entropy stated.
A list of tokens of the length and alphabet you chose, generated in the browser and never stored, with bits per character and total entropy — an ID and nonce generator, not a password manager.
Example: 16 alphanumeric characters grouped in fours carry 16 × log₂ 62 = 95.3 bits; 32 hex characters are 128 bits; a 22-character base64url string is 132 bits; "OTP-" + 6 digits is 19.9 bits.
Random bytes
turned into symbols.
Where the randomness comes from, how bias is avoided, and what the entropy figure means.
Source
Bytes come from crypto.getRandomValues, the browser’s cryptographic generator. Hex takes four bits per character; base64 and base64url take three bytes per four characters exactly as the encodings do (RFC 4648); other alphabets take one byte per character.
No bias
A 62-symbol alphabet does not divide 256 evenly, so "byte mod 62" would favour the first symbols. The page rejects bytes at or above the largest multiple of the alphabet size below 256 and draws again — every symbol is then equally likely. A custom alphabet is de-duplicated first.
Entropy
Bits per character = log₂(alphabet size); entropy per token = length × that. It measures how many equally likely tokens there are, given a good source. Prefixes and separators add characters, not entropy. This page generates identifiers and nonces and states what it made; whether a token is suitable as a secret, and how it is stored or rotated, is your policy. Nothing leaves the browser; the same four anonymous usage counts as the rest of the site apply.
SOURCES
- crypto.getRandomValues (Web Crypto) as the byte source; base64 / base64url alphabets per RFC 4648; other alphabets sampled by rejection (no modulo bias); entropy = length × log₂(alphabet size)
Last reviewed 21 September 2026. How results are checked: How we verify.