Generate a password
Use a password manager for generated passwords that are hard to memorize.
Password preset, length 20, lowercase + uppercase + numbers + symbols
A 20-character random password
Random String & Password Generator
Generate random strings, passwords, API-style tokens, hex values, and Base64URL-safe strings locally with Web Crypto.
Generate random strings for passwords, API-style tokens, hex values, Base64URL-safe identifiers, or custom alphabets without sending the generated value to a server. Generation uses the browser Web Crypto API, and the default Movement mode mixes local pointer movement into fresh random bytes.
Runs locally in your browser. Generated values, settings, and movement samples are not uploaded.Move inside the capture area to create block 1.No mouse button required. Block 1 of 3 will add 7 characters.
Movement complexity0% to green
0 / 421 complexity points. Longer strings move the green zone farther right.Block 10%
7 charactersBlock 27 chars
7 charactersBlock 36 chars
6 charactersGenerated output
Generated strings will appear here.
Entropy summary
Mode: Movement-assisted Web Crypto Alphabet size: 88 Length: 20 Estimated entropy: 129.2 bits per string Movement blocks: 3 (7 + 7 + 6 characters) Current green zone: 421 movement complexity points Movement samples are mixed locally and discarded after each block.
Store password-like strings in a password manager. Some sites reject certain symbols or limit length, so adjust the preset before using a generated value.
How to use Random String
- Choose a preset such as Password, API key / token, Base64URL, Hex, or Custom alphabet.
- Set the length and quantity. Longer strings with larger alphabets have more possible combinations.
- Use Movement mode for a guided local entropy step, or switch to Instant when you want Web Crypto generation without pointer movement.
- Copy the generated value and store password-like strings in a password manager.
Examples
Copy patterns and edge cases worth checking.
Generate a URL-safe token
Base64URL-safe strings are useful when a token must fit cleanly in URLs or config values.
Base64URL preset, length 32
A 32-character token using A-Z, a-z, 0-9, hyphen, and underscore
FAQ
Short answers before you paste real data.
Does this use Math.random?
No. Generation uses crypto.getRandomValues from the browser Web Crypto API. Character selection uses rejection sampling to avoid modulo bias.
Does mouse or touch movement replace Web Crypto?
No. Movement mode mixes local pointer samples with fresh Web Crypto bytes. The browser cryptographic random source remains the main source of security.
Are generated strings uploaded or saved?
No. Generated values, custom alphabets, settings, and movement samples stay in the browser session and are not sent to servers or external APIs.
Related tools
Useful next steps that also run locally in your browser.
Base64 Encoder/Decoder
Encode text to Base64 or decode Base64 back to UTF-8 safely in your browser.
JWT Decoder & Encoder
Decode JWT headers and payloads, inspect claims, or encode unsigned and HMAC-signed JWTs locally in your browser.
Text to Binary Converter
Encode UTF-8 text to binary bytes or decode binary back to text locally in your browser.