Random string generator

Type how many strings you want, up to 500, and they appear one per line. Length sets how many characters each one has, from 1 to 256. Characters picks what they're made of. Choose Your characters and type any set into the box next to it, such as ABCDEF or a run of emoji.

Your device makes the strings with crypto.getRandomValues, the random generator browsers provide for cryptography. Nothing is sent anywhere. Open the working under the result to see how strong they are.

A simple way to pick a character is to take a random number and keep its remainder after dividing by the size of the set. That has a flaw called modulo bias. A random 32-bit number has 4,294,967,296 possible values, which doesn't divide evenly by 62, so a few characters would come up very slightly more often than the rest.

Here, numbers from the last, incomplete block are thrown away and drawn again. Every character is then exactly as likely as every other. A redraw is rare, so it costs almost nothing.

Strength is measured in bits of entropy, L × log₂ N, where L is the length and N is the number of characters to pick from. Letters and digits give 62 characters, about 5.95 bits each, so a 16-character string carries about 95 bits. Each extra bit doubles the number of guesses an attacker would need.

How much is enough depends on the threat. Wikipedia's article on password strength gives a range from 29 bits, when only online guessing is possible, up to 96 bits for important cryptographic keys. Bit counts only hold for strings made at random, as these are, and not for ones a person makes up.