Random Generators
Five generators drawing on the same secure random source. What separates them is the shape of the answer and who reads it.
All 5 tools
Which one do you want?
All five draw from the browser's cryptographic random source, so none is more random than another. The question is never "which is strongest" — it is what the output has to look like, and who or what is going to read it.
| If you need | Use | Looks like |
|---|---|---|
| One long value for a machine to consume | Random String | UNvnWaXPLYZz… |
| One character at a time, read aloud | Random Character | q |
| A batch of codes a customer will redeem | Random Code | A7K9-P2XM-4RTV |
| An identifier that must be unique everywhere | UUID | 8f14e45f-ceea-… |
| Digits behind an attempt limit | PIN | 810938 |
Why the shape decides it
A random string and a random character come from the same function. What differs is that a string is copied as one value and a character is read out, so one is a line of text and the other is a large tile you can see from across a room.
A redemption code goes further: it will be typed by hand off a printed card, so it is grouped in fours, avoids the characters people misread, and can carry a check character that catches a typo before you look it up.
The two that are not really about randomness
A UUID is sized so that nobody ever has to coordinate — 122 random bits means two systems can generate identifiers forever without checking with each other. Uniqueness, not unguessability, is the job.
A PIN is the opposite extreme: short enough to type on a keypad, and safe only because something counts the wrong answers. Its page reports the odds under a three-try lockout rather than a strength band, because that is what actually decides the outcome.
One source, five interfaces
Every value on these pages comes from the browser's cryptographic random source. Four of the generators turn it into characters or digits with the same rejection-sampling code, which is what stops the first letters of the alphabet coming up about 11% more often than the last four.
A UUID needs no such step: its random bytes are written out as hex directly, and version 4 comes from the browser's own crypto.randomUUID(). Math.random() is never used.
Sharing that code means a correctness fix reaches all four at once. The interfaces stay separate because a teacher drawing a letter and a developer seeding a test fixture want different things from the same arithmetic.
Frequently asked questions
Which random generator should I use?
Choose by the shape of the answer. A random string is one long value for a machine to read; a random character is a single pick you read out; a random code is a batch of short codes people type in; a UUID is an identifier that must be unique everywhere; a PIN is digits for a keypad that limits attempts.
Are the results truly random?
They come from the browser’s cryptographically secure generator — crypto.getRandomValues(), or crypto.randomUUID() for version 4 UUIDs — which draws on the operating system’s own secure random source. Strictly speaking it is a pseudorandom generator, but its output cannot be predicted without its internal state. Where random values become characters or digits, rejection sampling keeps each one exactly as likely as the others.
Can the same value come up twice?
In principle, yes: every draw is independent. How likely it is depends on how many values the format allows. With 122 random bits a repeated UUID is not a practical concern, while a 4-digit PIN has only 10,000 possibilities. The random code generator is the exception within a batch — it never repeats a code.
Why are the default lengths so different?
Because each value defends against something different. A PIN can be short because the keypad counts wrong guesses. A redemption code defaults to 12 characters so that guessing a live one stays pointless even with thousands issued. A random string defaults to 32 characters because it may end up as a secret attacked offline, where nothing counts the guesses.
Can I download the results?
From three of them. The random string and UUID generators download their lists as plain text, and the random code generator as a CSV with a "code" header, ready for a bulk import. The PIN and random character generators copy to the clipboard instead.