About Us

What this site is

This is a set of generators for random strings, tokens, keys and identifiers. Every value is produced by JavaScript running in the tab you have open, drawing from crypto.getRandomValues(), which is the browser interface to the operating system random number generator. There is no server involved in generation, because the site is a set of static files and there is no server to involve.

It is written for developers, QA engineers and system administrators who need a value now and do not want to install a package or open a REPL to get one. The reference material on each page is written for the same reader. That means specification section numbers instead of adjectives, and a stated source for every figure.

The generator is one interactive component per page. Everything else is static HTML. The pages work with JavaScript disabled as far as reading goes, and the generator itself tells you when it cannot run rather than silently producing something weaker.

The position, and how to check it

Three claims hold this site up. Each one is stated because it can be verified from your side, not because it sounds good.

The first is auditability. The generation code runs in your browser, so the exact code that produces your values is delivered to you and can be read in your browser devtools. It is not obfuscated, not minified beyond what the build does, and not gated behind a domain check. The algorithm is also written out in full on the methodology page. One of the fifteen generators audited during research ships its generator as an inline script wrapped in 115 conditional guards that spell out its own hostname, which makes the code resist being read or run anywhere else. Ours keeps working with the network disconnected.

The second is provable uniformity. Picking a character with a modulo operation over a random 32-bit integer is very slightly biased, because 2^32 is not divisible by 62. The sampler here uses rejection sampling against the largest multiple of the alphabet size that fits in 2^32, so the mapping is exactly uniform. Constraints like "must contain at least one digit" are applied by generating a whole string and rejecting it if it fails, not by overwriting a fixed position, which would create a positional pattern.

The third is locality. Nothing you generate is transmitted, logged or stored. Seven of the fifteen generators audited produce their values on a server, which means the value exists in a request, a response body and whatever logs sit in between before it reaches you.

What we publish

The methodology page carries the algorithm, the sampler, and the statistical results for output this site actually produces. The release tests covered 25,000 strings of length 20 over a 62-character alphabet, which is 500,000 characters. Character frequency gave a chi-square of 72.51 on 61 degrees of freedom. Per-position frequency, which is the test that catches a badly implemented class constraint, gave 1171.06 on 1220 degrees of freedom. Adjacent repeats and serial pairs were tested too. None of them showed anything.

A suite that passes everything proves nothing, so a deliberately biased implementation was written and run through the identical tests. It failed three of the four. The fourth, the adjacent-repeat test, did not detect it. That is published as well, because a test that cannot catch a known bias is worth knowing about.

What this site does not claim

It does not claim better entropy than a hardware source. random.org samples atmospheric noise at roughly 12,000 bits per second, and that is a genuinely different and, in the strict sense, better source than a software generator seeded by your operating system. If physically sourced randomness is your requirement, use them. The difference is not entropy quality, it is where the value exists: their strings travel in a URL query string and an HTTP response body, and are logged on a server. Ours never leave the tab.

It does not claim that other generators are insecure. Fifteen were audited on the first page of search results for terms in this niche. Five use Math.random() somewhere in generator logic, which is a real problem for anything that has to be unguessable. Two implement rejection sampling correctly, which is the same thing done here. Seven generate on a server, and several of those use entirely sound cryptographic sources such as PHP random_bytes. Where a specific site is named anywhere on this site, the claim is drawn from its own shipped source, and the parts it gets right are named too.

Correct sampling is table stakes and not a differentiator. What was missing across the whole audited set is anyone publishing their algorithm alongside test results for their own output. That gap is the reason this site exists, and it is defensible only for as long as the work behind it is real.

Who runs it

One person. There is no company, no team and no investors behind this. That is not a pitch, it is context for how much weight to put on the site still being here in five years, and it is why the engine is being prepared for release as a standalone MIT-licensed package that can outlive the site.

There are no accounts. There is nothing to sign up for, no rate limit, no captcha, and no email address demanded before a download button works. There is no history of what you generated, because none is kept.

There are no ads today. If that changes, ads will be served by Google AdSense, placed below the tool and below its output and never beside generated material, and the privacy page and the changelog will say so on the day it happens. The privacy page already describes how that advertising would work.

Nothing you generate is tracked. Not the values, not their length, not which character sets you picked, not how many you asked for. The site uses Google Analytics to count which pages are visited, and the privacy page sets out exactly what it receives and how your settings are kept out of it.

What is on the site

The generators are grouped so that a page you have used once tells you how every other page works.

• General string generation, with character class toggles, a custom alphabet, exclusions and structured output formats.
• The UUID family, including version 7 from RFC 9562 with a monotonic counter and decoded timestamps.
• Secrets: API keys, encryption keys and the framework-specific formats such as Django and WordPress.
• Primitives: hex, raw bytes, base64 and base64url, tokens and hashes.
• Modern identifier formats: Nano ID, ULID and KSUID.
• Calculators that show the working: entropy, collision probability, and a UUID inspector that decodes version, variant and timestamp.