Every generator

66 tools, all built on the same engine: crypto.getRandomValues() with unbiased character selection, running entirely in your browser.

Strings

The general-purpose builders, with full control over length and character set.

Hex Hex bytes for keys, and hex codes for colours Bytes Raw entropy, shown as hex pairs you can count Base64 RFC 4648 section 4 and section 5, padded or not Hash-shaped Digest-width random hex, 32 bytes as 64 characters

UUID and GUID

RFC 9562 identifiers, including the time-ordered version 7.

UUID generator v4 and v7, every format, bulk output UUID v7 Time ordered, sorts by creation, ideal for database keys UUID v4 The random UUID: 122 random bits, no timestamp, no coordination GUID generator Braced, uppercase and all five .NET format specifiers

Modern identifiers

Shorter, sortable and URL-safe alternatives to the UUID.

Short UUID 22 base58 characters, converts back to a canonical UUID Nano ID Short, URL-safe, 126 bits at the default length ULID Sorts by creation time, 26 characters, no look-alike letters KSUID 27 base62 characters, 128 random bits, sorts to the second

Keys and secrets

API keys, framework secrets and encryption keys, at the right length.

API key 32 characters of base62, with the prefix and storage rules explained Secret key General-purpose application secrets, plus the framework-specific pages JWT secret 32 bytes for HS256, with the signature attacks explained Django SECRET_KEY 50 characters, plus what it signs and what rotating it invalidates WordPress salts Eight 64-character values, and what each constant actually protects Encryption key Keys by bit size, with the password-is-not-a-key trap explained AES key 16, 24 or 32 bytes, plus the GCM nonce rules that matter more Token Session and bearer tokens, with entropy in bits

Numbers and digits

Digit strings that keep their leading zeros, and integers over a range.

Number Uniform integers over an inclusive range, no modulo bias 3-digit number 000 to 999, the full 1,000-value space 4-digit PIN The full 10,000-value PIN space, zeros included 5-digit code 00000 to 99999, leading zeros preserved 6-digit OTP OTP-shaped codes, 19.93 bits, zeros preserved 8-digit reference 100 million values, with the collision maths 10-digit number 10 billion values, with the phone-number warning 12-digit reference A trillion values, still not collision-free 16-digit number Card-shaped length, with the Luhn maths explained

Character sets

Pick exactly which characters can appear, including your own alphabet.

Text block Random character blocks for layout and fixture testing Alphanumeric A-Z, a-z and 0-9. The default for identifiers that travel Hex string Exactly 4 bits per character, with the byte count shown With symbols Named symbol presets, with the compatibility trade-offs spelled out Binary string Ones and zeros, one bit per character, leading zeros kept Uppercase letters A to Z only, case-insensitive by construction Letters only A-Z and a-z, for fields that reject digits Digits only A numeric string, not a number. Leading zeros survive Custom alphabet Any character set, parsed correctly and priced honestly

By length

Preconfigured for a specific length, with the entropy that length actually buys.

6 characters Short codes and invite codes, with the duplicate maths 8 characters The legacy password minimum, and what replaced it 10 characters Reference and order codes, 4.5 bits under the NIST line 12 characters The practical floor for a typed password, with the PCI and NIST split 16 characters The reference length for keys and tokens, at 95.3 bits 32 characters Session tokens and secrets, past the point brute force matters 64 characters Where 64 characters is genuinely required, and where it is not Long strings 128 to 4,096 characters, and where long strings get cut off

Passwords

Built around what NIST SP 800-63B-4 actually requires.

Password generator Strong passwords with the real entropy, not the marketing number 8 characters 49.7 bits, below the NIST minimum, and we say so 12 characters The PCI DSS floor, at 74.5 bits 16 characters 99.4 bits, above the NIST minimum, below every field limit 20 characters 124.2 bits, the length for anything a password manager holds

Bulk

Thousands at a time, in your browser, with a working cancel.

Bulk UUIDs 10,000 in one batch with JSON, CSV and SQL INSERT export Bulk passwords Batches for provisioning, with the distribution problem taken seriously Bulk strings Large batches, chunked and cancellable, with real exports 100 random strings A hundred at once, with the collision maths shown

By programming language

The same generator, with code for doing it yourself that was run on the real runtime.

Python secrets.choice, token_urlsafe and the random.choices trap JavaScript getRandomValues without modulo bias, for browsers and Node.js Java SecureRandom, Base64 tokens and RandomStringUtils by version PHP random_int, Randomizer::getBytesFromString and the str_shuffle trap C# GetString, GetInt32 and the System.Random trap, for .NET C++ random_device, uniform_int_distribution and why mt19937 is not a secret PowerShell Get-Random, Get-SecureRandom and the -Count trap, for 5.1 and 7

Calculators and inspectors

Tools that work out or decode something rather than producing a new value.

Passphrase generator EFF Diceware wordlists, with honest entropy accounting UUID inspector Decode version, variant and the embedded timestamp Collision calculator Birthday bound at both common thresholds Entropy calculator Corrected for classes, exclusions and repeats

What every one of them has in common

One engine, one set of guarantees. Values come from the operating system CSPRNG through crypto.getRandomValues(), the mapping from bits to characters uses rejection sampling so no character is favoured, and nothing you generate is transmitted, logged or stored. The methodology page has the algorithm and the test results.