Is the random string generator free?
Yes. It is completely free to use, with no signup, no account, and no paywall.
Do I need to install anything?
No. It runs in any modern browser on desktop or mobile, with nothing to download and nothing to configure.
Does it stay local?
Yes. Generation happens entirely in your browser, and nothing is sent to a server.
Can I use this for an API key or a token?
Cryptographically, yes. The characters are drawn from the browser's cryptographically secure generator with rejection sampling, so the output is unpredictable and uniformly distributed, and a 32-character alphanumeric string carries roughly 190 bits of entropy. The caveat is operational rather than mathematical: a secret generated in a browser tab has been in your clipboard and possibly in a paste buffer, which is more exposure than a production credential should have. For a real service key, generate it on the machine that will use it.
How long should a random token be?
Thirty-two characters from the alphanumeric pool is a sensible default and gives you far more entropy than any attacker can search. Below about 16 characters you are approaching the range where a determined adversary with a fast endpoint could brute-force it, particularly if your service does not rate-limit. Above 32 you are adding length with no security benefit, and long tokens have real costs in log size, URL length, and human error.
Is this the same as the password generator?
The randomness source is the same, and the difference is in the guarantees. The password generator ensures at least one character from each selected class, because sign-up forms demand it, and then shuffles. This one draws every character uniformly from a single pool, which is marginally more entropy per character and the right behaviour for a machine-readable token where no form is going to reject it for lacking a symbol.
Why do I get strings with a zero next to a capital O?
Because the pool includes every alphanumeric character and none are excluded. That is correct for a token a machine will read and irritating for one a human will type from a screen or read down a phone line. If the string will ever be transcribed by a person, use an alphabet designed for it, such as Crockford's base32, which removes I, L, O, and U precisely to avoid this class of error.
Does the string leave my browser?
No. It is generated on your device and never transmitted, logged, or stored. Since the usual reason to generate a random string is that it will be a secret, that property is the point.