Random Text Generator

Random character strings and word-list passphrases, generated in the page with a stated entropy figure so you can tell whether what you just made is actually strong.

Where the randomness comes from

Every character is drawn using crypto.getRandomValues, the browser's cryptographic random source, with rejection sampling on top.

The rejection step is the part that usually gets skipped. A 32-bit random number has 2^32 possible values, and 2^32 divides evenly by almost no alphabet size — not 50, not 62. Taking the remainder directly would make the first few characters of the set slightly more likely than the rest, a small bias that compounds across every position. Instead, draws landing in the uneven tail are discarded and replaced. The loop costs microseconds and makes every character exactly equally likely.

Math.random() would not do. It is fast and evenly distributed but predictable — its internal state can be recovered from a short run of outputs — whereas crypto.getRandomValues draws from the operating system's entropy pool.

What the bits figure means

Entropy in bits is the base-2 logarithm of how many equally likely values the generator could have produced. Each extra bit doubles the search space.

The default settings — 20 characters from lowercase, uppercase and digits, look-alikes excluded — leave a 50-character alphabet, so the figure reads 112.9 bits. That is 20 × log2(50), and it is exact rather than indicative, because no hidden "must contain one digit" rule is quietly shrinking the set of possible outputs. Rules of that kind are what make most strength meters wrong: every constraint removes candidates, so the honest bit count goes down, not up.

The page names the band beside the number: under 40 bits is throwaway test data, 40 to 60 is acceptable only behind serious rate limiting, 60 to 80 is strong, and above that is beyond brute force.

Passphrases against character strings

Passphrase mode draws whole words from a 455-word list, joined by a separator you choose. Each word contributes about 8.83 bits, so five words carry 44.1 bits and seven carry 61.8. If a human has to retype it, seven words is the sensible floor.

Two options deliberately barely move the number. Capitalise each word applies the same transformation every time, so it adds no uncertainty at all and the tool does not pretend otherwise. Append a digit adds log2(10), or 3.3 bits, taking five words from 44.1 to 47.5. Neither turns a short passphrase into a good one.

The word list is not a secret and cannot be. Assume an attacker has it. All the strength lives in how many words you drew, which is exactly what the bit count already reflects.

Excluding the look-alike characters

The look-alike filter removes I l 1 | O 0 o B 8 S 5 Z 2, the glyphs people misread off a screen or a printed sheet. Use it for anything that will be dictated over a phone or typed from paper.

It costs entropy. The 62-character alphanumeric set drops to 50, so a 20-character string falls from 119.1 bits to 112.9. That is a fine trade at this length, and a poor one at very short lengths, where the answer is to add a character rather than keep the ambiguous ones.

What the number does not cover

An entropy figure describes the generator, not your situation. It says nothing about whether the service you paste the value into hashes it properly, or whether the machine you generated it on is already compromised.

Nothing is saved here. Reload and the value is gone. Pressing Copy does put the value on your system clipboard, though, where other applications can read it — paste it where it belongs, then copy something harmless over it.

Elsewhere in the toolset

• UUID Generator — identifiers rather than secrets.
• Hash Generator — digest a value instead of inventing one.
• Lorem Ipsum Generator — readable placeholder prose for layout work.