Home / Random String Generator

Random String Generator

Cryptographically secure random strings for API keys, tokens, salts and IDs — generated locally.

…

STRENGTH—

—Length

—Character Set

—Entropy

—Crack Time

Length32

8128

Format

How it works

This tool produces a random string in the format you need: hex, Base64url, alphanumeric, lowercase alphanumeric, or a UUID v4. Use it for API keys, session tokens, salts, webhook secrets, database IDs and one-off identifiers — anything that must be unguessable but is never typed by a human.

Every character comes from crypto.getRandomValues(), the browser's cryptographically secure generator, and nothing is sent anywhere. For a secret that protects real access, use at least 128 bits of entropy — for example 32 hex characters or 22 Base64url characters.

How long should it be?

Salt — 16 bytes (32 hex characters). Uniqueness matters more than length.
Session token or API key — 128 bits: 32 hex, 22 Base64url or 24 alphanumeric characters.
Signing key or long-lived secret — 256 bits: 64 hex or 43 Base64url characters.
One-time code in a URL — 128 bits minimum; treat it like a password.

Beyond 256 bits there is nothing an attacker could ever exhaust. Keep secrets out of source control and logs, and rotate one the moment it is exposed.

Related terms: Entropy · CSPRNG · Hash

FAQ

How long should a secret key be?

At least 128 bits of entropy for anything protecting access: 32 hex characters, 22 Base64url characters, or 24 alphanumeric characters. Use 256 bits (64 hex) for signing keys and long-lived secrets.

Hex or Base64?

Base64url packs more entropy per character, so the string is shorter for the same strength and it stays URL-safe. Hex is easier to read and copy by eye. Both are fine.

Is a UUID v4 random enough to use as a secret?

A v4 UUID has 122 bits of randomness, which is strong, but its format is well known and UUIDs are often logged or exposed. Prefer a dedicated 128-bit token for secrets and keep UUIDs for identifiers.