Changelog

How this page works

Entries are newest first and dated in ISO form. Anything that changes the generation engine, changes a published statistical result, or corrects a number stated anywhere on the site gets an entry naming what was wrong and what it is now. Corrections are recorded rather than quietly applied, because a site whose whole claim is traceable numbers cannot edit numbers silently.

Cosmetic and copy changes are not logged.

2026-09-16 - Google Analytics added

Google Analytics 4 now runs on every page. The privacy policy, the about page and this changelog said there was no analytics. That was true until this change and is not true now, so they were rewritten in the same release.

The privacy policy had also said that any analytics added later would be cookieless, first-party and loaded after the generator. Google Analytics is none of those, so that commitment is withdrawn rather than left standing beside a tag that breaks it. The part that matters most still holds: analytics has no access to generated values or to generator settings.

Generator settings are removed from the page address and from a same-site referring address before any measurement is sent, and a settings change is not reported as a page view. Pressing Generate still issues no request. Both were checked by capturing every request in a headless browser, with the measurements blocked so the test did not reach the real analytics property.

In the European Economic Area, the United Kingdom and Switzerland, analytics cookies are off by default and Google Analytics measures without them.

2026-09-15 - language guides, and three corrections

Added random string guides for Python, JavaScript, Java, PHP, C#, C++ and PowerShell, and a long random string generator. Every code example on those pages is executed on the real runtime by a verification script before release, and the runtime versions used are named on each page.

The site said Get-Random in PowerShell is not a cryptographic source. It is: without -SetSeed it draws from the system cryptographic generator in both Windows PowerShell 5.1 and PowerShell 7, which was confirmed in the PowerShell source and by inspecting 5.1 directly. The homepage now says so, and warns about Get-Random -Count instead, which never repeats a character.

Several pages said that placing one character from each required class and then shuffling is uniform as long as the shuffle is unbiased. It is not uniform even with a perfect shuffle; an exhaustive check over a small alphabet found some valid strings a third more likely than others. The wording is corrected on the character set, length and methodology pages and in the token mistakes article.

The methodology page gave 2.17 expected attempts for a sixteen-character password with four required classes. 2.17 is the figure for eight characters over 94 symbols; at sixteen characters it is 1.215.

2026-09-15 - claims about the published source corrected

The about page and the terms said the generation source was published under the MIT licence. It was not. The engine has been packaged for release but has not been published anywhere, so those statements were wrong and have been rewritten to say what is true: the code that runs on each page can be read in browser devtools, the algorithm is on the methodology page, and the package will be linked when it is released.

The privacy policy said the output format was remembered between visits. It never was, and the sentence now lists only what is actually saved. It also now says that pages built around one setting, such as the 32-character and binary generators, always open with that setting rather than a remembered one.

2026-09-14 - input handling and page presets

Blind testing found that settings remembered from one page were overriding the setting a page is named for, so a 32-character string generator could produce 24 characters and the binary string generator could produce letters. Pages now keep the settings they are built around, and constraints that depend on the alphabet, such as excluding look-alike characters, no longer carry across onto them.

The random number generator accepted bounds above 2^53 and reported an entropy figure for them, although JavaScript numbers cannot represent every integer in that range. Those bounds are now refused with a message. The UUID inspector no longer reports random bits for UUIDs whose variant is not the RFC 9562 layout. The collision calculator no longer reports zero values for thresholds that the very first pair already exceeds.

2026-09-13 - privacy policy and terms prepared for advertising

No ads have been added. The privacy policy now carries an advertising section describing how Google AdSense would use cookies and how to opt out, so that the policy is in place before any change rather than after it. The terms gained a section on advertisers and links to other sites.

A sentence on the privacy page claimed a content security policy blocked connections to other origins. No such policy was being sent, so the claim was wrong and has been removed. Pages still make no requests to other origins, which the network panel confirms.

2026-09-05 - initial release

First public version. The engine, the verification suite and the first set of generator pages.

The engine takes all of its randomness from crypto.getRandomValues() and has no fallback path. If Web Crypto is unavailable it throws rather than degrading to something weaker, because a silent downgrade is the worst possible failure for a tool like this. Requests are chunked at the 65,536-byte per-call quota, and draws are served from a pooled buffer so that generating ten thousand strings does not mean one call per character.

Characters are selected by rejection sampling against the largest multiple of the alphabet size below 2^32, so the mapping from random bits to characters is exactly uniform with no modulo bias. Class constraints such as "at least one digit and one symbol" are applied by generating a complete string and rejecting it if it fails, which is uniform over the set of valid strings, rather than by overwriting fixed positions, which is not. Shuffling is Fisher-Yates with indices drawn from the same unbiased sampler.

Verification ran over 25,000 strings of length 20 from a 62-character alphabet, which is 500,000 characters, at a significance level of 0.001. Four tests were applied to the output and the same four to a deliberately biased control implementation. The control failed three of them. The adjacent-repeat test did not detect the control, and that is stated here rather than left out, because a test that misses a known bias should not be counted as evidence.

Bulk performance is measured rather than asserted. The published target is 10,000 strings of 32 characters in under 200 milliseconds with no chunk holding the main thread longer than one frame, and the timings actually recorded at 100, 1,000 and 10,000 are printed on the methodology page alongside the machine that produced them. A latency figure is hardware-dependent in a way a chi-square result is not, so it is published where it can be re-run rather than quoted here.

What shipped on 2026-09-05

The launch set covers the generators below, plus the methodology page carrying the algorithm and the full test output.

• General random string generation with character class toggles, a custom alphabet, exclusions, class constraints and structured output formats.
• The UUID family, including RFC 9562 version 7 with a monotonic counter within a millisecond and decoded timestamps.
• Secrets: API keys, encryption keys, and the framework-specific formats including Django and WordPress.
• The primitive encodings, each with the byte count stated beside the character count: hex, raw bytes, base64 and base64url, tokens and hashes.
• Numbers, character-set variants and fixed-length variants.
• Nano ID, ULID and KSUID, with the collision arithmetic for each length.
• Calculators: entropy, collision probability, and a UUID inspector that decodes version, variant and creation timestamp.

Deliberately not in this release

There is no public HTTP API. A generator reached over the network cannot make the locality claim this site is built on, so if an API is ever offered it will be a separate product with its own page and its own privacy statement, and it will not change how these pages work.

At launch there was no analytics, there were no cookies and there were no ads. That was a launch state, not a promise about every future version. Google Analytics was added on 2026-09-16, as recorded above.