Free Online Random Code Generator
Create cryptographically secure random codes for passwords, PINs, verification codes, API keys, tokens and license keys. Choose the code type, length and grouping, see the exact entropy and time to guess, and generate one code or a batch of up to 50.
100% client-side · Web Crypto randomness · Nothing you generate is stored or sent
Time to guess assumes 10 billion guesses per second against a leaked hash. Hyphens added by grouping are not counted in the length or the entropy.
Codes exist only on this page. Copy or download what you need before you close it.
How the Random Code Generator Works
A secure code is only as unpredictable as its source of randomness. This page asks your browser’s cryptographic random number generator for 32-bit values and turns each one into a character with rejection sampling: values that would favour some characters are thrown away, so every allowed character has exactly the same chance at every position.
Strength is measured in bits of entropy, which is the length multiplied by log2 of the alphabet size. When you generate custom codes with several character sets, the page keeps only codes that contain at least one character from each selected set, and counts exactly how many such codes exist, so the entropy it shows is not overstated. Each extra bit doubles the work needed to guess the code.
Web Crypto Randomness
Every character comes from crypto.getRandomValues, never Math.random
Exact Entropy
Bits of entropy, possible codes and average time to guess, recalculated for your settings
Unbiased Sampling
Rejection sampling gives every allowed character exactly the same chance
Five Code Types
Custom characters, numeric, hexadecimal, Crockford Base32 and Base58
Batch and Export
Up to 50 unique codes, copy one or all, or download a text file
Nothing Stored
No outside scripts, no history and no network requests
Explore more free tools in our security tools collection, including our strong random password generator.
Frequently Asked Questions
1. How secure is this random code generator?
Every character comes from your browser’s cryptographically secure random number generator (the Web Crypto API, crypto.getRandomValues). Each position is chosen with rejection sampling, which removes the small bias that a simple remainder calculation would add, so every allowed character is equally likely. Math.random() is never used.
2. How is the entropy and strength worked out?
Entropy is the number of bits needed to describe the code: length multiplied by log2 of the alphabet size. When you ask for every selected character set to appear at least once, the page counts exactly how many codes meet that rule (inclusion–exclusion) and uses that smaller number, so the figure is not overstated. Strength labels follow the entropy: under 36 bits is weak, 36 to 59 fair, 60 to 79 strong and 80 or more very strong.
3. What does the time-to-guess figure mean?
It is the average time an attacker needs to find the code by trying every possibility at 10 billion guesses per second, which models fast offline cracking of a leaked hash. Online attempts against a login form are far slower, and a well-built service also limits attempts. Treat the figure as a comparison between settings, not a promise.
4. Which code type and length should I choose?
For a password or account secret aim for at least 80 bits of entropy, for example 16 or more characters from all four character sets. For API keys and tokens use 128 bits or more, such as 32 Base58 characters or 32 letters and digits. For a six-digit verification code only about 20 bits are possible, so rely on short expiry and attempt limits on the server.
5. Why are there Base32 and Base58 types?
They drop characters that are easy to confuse. Crockford Base32 leaves out I, L, O and U, which makes codes easy to read aloud and type, and is a good fit for license keys. Base58 leaves out 0, O, I and l and is common for tokens and wallet-style identifiers. Hexadecimal is available for keys and hashes that must use 0 to 9 and a to f.
6. What do grouping and the look-alike option do?
Grouping inserts a hyphen every 3 to 6 characters, such as ABCDE-FGHJK-MNPQR-STVWX, which is easier to read and copy. The hyphens are not counted in the length or the entropy. Excluding look-alike characters removes 0, O, 1, l, I and | from the custom character sets, at a small cost in entropy that the page recalculates.
7. Can I generate several codes at once?
Yes. Set the number of codes from 1 to 50. Every code in a batch is generated independently and a batch never contains the same code twice. Copy a single code, copy the whole list, or download the list as a plain text file.
8. Are my codes stored or sent anywhere?
No. Codes are created on your device, the page’s content security policy blocks outgoing network requests, no outside scripts are loaded, and none of what you create is saved in cookies or local storage (the page only remembers your chosen site language). Closing or reloading the tab discards the codes, so copy or download anything you need to keep.