scriptiii
100% Client-Side

CSPRNG · entropy in bits

Random string and password generator

Generate a random string from the platform CSPRNG, choose exactly which characters may appear, and read the real entropy instead of a colour-coded guess.

Character sets

24 characters from 85 possible characters — about 153.8 bits.

The string is produced by crypto.getRandomValues in this tab. It is never transmitted, logged or stored, which also means nobody — including this site — can recover it for you.

Short answer: set the length, choose the character sets and press Generate. The entropy line tells you how many bits of randomness the string actually has, and the strength badge says what that is adequate for. Nothing is stored, so copy it before you close the tab.

Why the entropy figure is honest

Strength meters on the web usually score character classes and call it a day, which lets a value like Password1! pass as "strong". The number here is the size of the space the string was drawn from: length × log₂(alphabet). It is a fact about the draw, not a claim about the secret. 16 characters from 62 symbols is about 95 bits; 24 from 85 is about 154.

If the string is reused across services, or pasted into a chat window, its effective strength is whatever the weakest handling of it is. No generator can fix that.

Uniform, not just random

Taking byte % alphabetLength biases the first characters of the alphabet, because 256 does not divide evenly by most lengths. This generator discards the biased tail and redraws, then shuffles with the same source so a guaranteed character is not always first. The unit tests assert the shape of the output and the entropy maths, not the specific string.

What not to use it for

For identifiers that will live in a database, a UUID is the better shape. For verifying a download, use thehash generator.

Random string questions

How is this different from Math.random()?

Math.random is not suitable for secrets: it is a fast deterministic generator whose internal state can be recovered from a few outputs. This page uses crypto.getRandomValues, the platform CSPRNG, and rejects the biased tail of the byte range so every character is equally likely.

What does the entropy number mean?

It is length × log₂(alphabet size) — the number of equally likely possibilities, expressed in bits. 24 characters from the 85 characters this page offers (letters, digits and 23 symbols) is about 154 bits. It describes this string only: if you reuse it, share it, or paste it into a chat, the effective strength is whatever the weakest place it has been is.

Should I use this instead of a password manager?

No. Use it for a one-off token, a test fixture or a throwaway secret. A password manager generates, stores and fills passwords, which is the part that actually keeps an account safe. This page keeps nothing: close the tab and the value is gone unless you saved it.

Why exclude ambiguous characters?

I, l, 1, O, 0 and o are easily confused when a value is read aloud, copied from a screen or retyped from paper. Removing them costs a few bits of entropy and prevents a class of support tickets. The entropy line updates so you can see the cost.

What does “one from each set” guarantee?

Many systems reject a password that lacks a digit or a symbol. With the option on, the result contains at least one character from every set you selected, then the rest is filled and the whole string is shuffled so the guaranteed characters are not stuck at the front.

Is the generated string sent anywhere?

No. It is created in this tab and never leaves it. There is no analytics event carrying the value, no console log, and no network request — the page only fetches its own static assets.

Related tools

UUID generatorv4 and time-ordered v7 identifiers.Hash generatorMD5 to SHA-512, text or file.Base64 encoder and decoderTurn a token into a transport-safe value.JSON formatterDrop the token into a fixture.