PassGenFast

For developers

Random string generator

A random string for an API key, a token, a salt or test data. Same secure source as the password generator, without the rules a login form imposes.

Generator

Generating…

Strength: Very strong

191 bits of entropy

At the displayed attack rate, exhaustive search is far beyond the age of the universe.

At 100 billion guesses a second, an offline attack would take longer than the universe has existed. That rate assumes a site stored your password badly; a properly stored one takes far longer to attack.

32
4128
Characters

Generated in your browser with crypto.getRandomValues. Nothing is sent to us, and the page keeps working with your connection switched off.

The same engine, minus the login-form rules

This is the password generator with the constraints removed. No requirement that every character class appears, because no API validates a token that way, and no assumption you are going to type it by hand. What is left is the thing a developer actually wants: an arbitrary number of uniformly random characters from a pool you choose.

Everything else is identical. The characters come from crypto.getRandomValues, values that would introduce a bias towards certain characters are discarded and redrawn, and nothing leaves the page.

How long is long enough

The usual target for a secret is 128 bits of entropy, which is the point at which guessing is no longer anybody’s route in. What that means in characters depends on the pool:

Characters needed for 128 bits of entropy by pool
PoolSizeBits per characterCharacters for 128 bits
Digits only103.3239
Lowercase only264.7028
Letters and digits625.9522
Everything866.4320

The gap between the safest and the most convenient pool is two characters. That is the whole argument for leaving symbols out of anything that will pass through a shell, a URL or a config file.

What these are good for

  • API keys and bearer tokens — 32 characters of letters and digits is a sensible default.
  • Salts — though a hashing library will usually generate its own, and should be allowed to.
  • Session identifiers — as long as they are treated as secrets and not logged.
  • Test and seed data — where you want values that look real and collide with nothing.

What they are not good for

Anything that has to survive being read aloud, retyped or transcribed. A 32-character random string is hostile to human hands, which is exactly right for a machine credential and exactly wrong for a login someone has to type. For that, use the passphrase generator.

These are also not a substitute for a key derivation function. If you are turning a password into an encryption key, use a proper KDF such as Argon2 or scrypt rather than a random string, and let the library handle the salt.

Password generator

The main tool: random characters, any length, with an honest strength readout.

Passphrase generator

Real words you can actually remember, for the passwords you have to type by hand.

Username generator

Word pairs and invented handles for gaming, social and sign-ups.

UUID generator

Random v4 UUIDs, one or twenty-five at a time, straight from the browser's CSPRNG.

PIN generator

Random digits for a card or a lock, with an honest note on how little a PIN protects.

General information, not security advice for your particular situation. Last reviewed August 12, 2026.

Answers

Frequently asked questions

Is this random enough for an API key or a token?

Yes. Every character comes from crypto.getRandomValues, the browser's cryptographic random source, and the draw is corrected so no character is more likely than another. That is the same standard you would want from a library. What the page cannot do is protect the value afterwards — once it is on your clipboard and in a config file, the handling is yours.

Source: MDN: Crypto.getRandomValues()

How long should a token be?

For anything acting as a bearer credential, aim for at least 128 bits of entropy. With letters and digits that is 22 characters; with symbols added, 20. The default here is 32 characters of letters and digits, which is about 190 bits — comfortably past the point where guessing stops being the weak link.

Why is there no 'one of each type' option?

Because nothing consuming a token cares, and forcing a composition rule shrinks the pool of valid values slightly. That rule exists on the password generator only because some login forms demand it. Here, an unrestricted uniform draw is both simpler and marginally stronger.

Should I switch off symbols?

Often, yes. Symbols add entropy per character, but they also get mangled: shell quoting, URL encoding, CSV imports and copy-paste into config files all have opinions about punctuation. Letters and digits only, two characters longer, gets you the same strength with none of the escaping problems. That is why symbols are off by default here.

Can I generate several at once?

Not on this page. Press the button again for another. If you need a batch of identifiers rather than secrets, the UUID generator produces up to twenty-five at a time.