Comprehensive randomness toolkit - custom-charset strings, advanced passwords with entropy scoring, preset tokens (UUID, hex, JWT secrets, Luhn-valid test cards) and bulk numeric ranges.
# = random char from charset; literals kept as-is. Overrides length.
crypto.getRandomValues(). Cryptographic-quality entropy; nothing transmitted.Code / Password / Token Generator is the all-purpose randomness console for bug-bounty & pentest workflows. It produces anything from a 4-digit OTP for rate-limit testing through a 512-character API key in your choice of charset, with platform-conventional formats (UUIDs, Stripe-style sk_test_…, GitHub-style ghp_…, Slack-style xoxb-…, AWS-style AKIA…) and Luhn-valid test credit-card PANs all one click away.
Every random byte comes from crypto.getRandomValues() with rejection-sampling to avoid the modulo bias most ad-hoc generators ship with. Tests confirm uniform distribution across non-power-of-2 ranges and valid RFC-4122 v4 UUIDs and Luhn-valid PANs. Everything runs client-side - not a single generated value ever leaves your browser.
Four focused tabs cover the workflow: Random String / Code for arbitrary charset + length + count, Password with live entropy scoring and pronounceable / passphrase modes, Tokens & Identifiers as a preset library, and Numeric Range for min/max/count with padding and sequential / random / unique modes.
O2T5U1R4A0N). 1-512 chars per item, up to 5000 items per batch, with optional prefix / suffix / pattern (####-####-####) and no-duplicates dedupe.Il10O) and ambiguous symbols, minimum N digits / symbols enforced, with a live entropy score and a "would take X years at 10 B guesses/sec" estimate.+1 E.164 phones, test+<random>@example.com email aliases (Gmail-style + addressing for account-creation fuzz), random IPv4 / IPv6 / MAC addresses.crypto.getRandomValues() + rejection-sampling on every random choice. Verified uniform across non-power-of-2 ranges in unit tests.test+xxx@example.com aliases bypassing per-email dedupe.This one is free in your browser. Sign up for server-side recon, scan history, and projects.
Create free account Sign inNo - they replicate the **shape** of well-known providers (Stripe, GitHub, Slack, AWS) so you can populate forms / log entries / configuration with realistic-looking but synthetic values. They are not valid credentials and will not authenticate against any real service.
Yes - they are randomly-generated Luhn-valid PANs. They are not linked to any real account; a real card processor will reject them at authorisation. Use them for testing your own card-validation logic. Never enter them into a production payment gateway you don’t own.
Yes. Every random byte comes from the Web Crypto API’s crypto.getRandomValues(). Integer ranges use rejection-sampling so non-power-of-2 ranges (e.g. picking 1 of 36) are uniform, not biased toward smaller numbers like a naive modulo would be.
No. The tool is 100% client-side. No telemetry on generated values, no server-side generation, no analytics on inputs.
A practical browser-side ceiling - 5000 lines fit comfortably in a textarea and a clipboard. For larger lists chain the tool with shell tools: copy 5000, append, repeat.