Generators for the values developers and testers actually need: passwords, API tokens, UUIDs, raw bytes, hex, Base64, dates, coordinates, IP and MAC addresses, HTTP status codes, synthetic records and JSON. Everything is produced in your browser with its cryptographic random source, and nothing generated here is transmitted, stored or logged.
Your favourites
Recently used
Start from what you are trying to do
- Generate test data for a fixtureA realistic JSON fixture you can drop into tests.4 steps, starting with Random Test Data Generator
- Secure Password GeneratorGenerate strong passwords in your browser using its cryptographic random source.
- Random String GeneratorGenerate random strings of any length from the character sets you choose, or from your own custom alphabet.
- Secure Token GeneratorGenerate API keys, session tokens and other secrets with a stated entropy budget in bytes.
- UUID GeneratorGenerate UUIDs in version 4 (random) or version 7 (time-ordered), plus the nil and max special cases.
- Random Bytes GeneratorGenerate raw random bytes for keys, salts and initialisation vectors, formatted as hex, spaced hex, Base64, decimal or a C array.
- Random Hex GeneratorGenerate random hexadecimal values of any length, with optional uppercase and 0x prefix.
- Random Base64 GeneratorGenerate random Base64 strings from a chosen number of random bytes, with standard or URL-safe alphabets and optional padding.
- Random Date and Time GeneratorGenerate random dates and times inside any range, formatted as ISO 8601, date only, time only, Unix seconds, Unix milliseconds or a readable string.
- Random Coordinates GeneratorGenerate random latitude and longitude pairs inside a bounding box, exported as plain text, CSV or GeoJSON.
- Random IP Address GeneratorGenerate random IPv4 and IPv6 addresses, including the blocks reserved for documentation so an example can never point at a real host.
- Random MAC Address GeneratorGenerate random MAC addresses with colon, hyphen, dot or bare formatting.
- Random User Agent GeneratorGenerate synthetic user agent strings for Chrome, Firefox, Safari and Edge across desktop and mobile platforms.
- Random HTTP Status Code GeneratorPick random HTTP status codes from the IANA registry, filtered by family — informational, success, redirection, client error or server error.
- Random Test Data GeneratorGenerate synthetic records with the fields you choose, exported as CSV, JSON or SQL inserts.
- Random JSON Data GeneratorGenerate valid JSON in four shapes — an array of user objects, a nested object tree, a flat key/value map, or an API response envelope.
- Random Unicode Character GeneratorGenerate random characters from a chosen Unicode block — Latin, Greek, Cyrillic, CJK, arrows, mathematical operators, box drawing or emoji.
Frequently asked questions
What is in this collection?
Sixteen generators for the values developers and testers need: passwords, API tokens, UUIDs, random bytes, hex, Base64, dates and times, coordinates, IP and MAC addresses, HTTP status codes, user agent strings, synthetic records, JSON and Unicode characters. Each one is a full tool with its own controls and export formats rather than a variation on a single generator.
Where does the randomness come from?
Every tool draws from crypto.getRandomValues, the cryptographically strong generator built into your browser, mapped onto the required range with rejection sampling so no value is favoured over another. A seeded mode is available on every tool for when you need reproducible output instead.
Is it safe to generate real secrets here?
The generation is sound and nothing leaves your browser. The residual risk is the environment: a value shown on screen may pass through your clipboard and could be seen by other software on the machine. For production secrets, generating them on the server that will use them avoids that exposure. For development, testing and fixtures, these tools are appropriate.
Is any generated value stored or transmitted?
No. Everything is produced in the page. Nothing is uploaded, written to storage, recorded in analytics or placed in the page URL — none of these tools offers a share link, deliberately, because a link that reconstructed a secret would defeat the purpose.
Why do the data generators use reserved addresses and domains?
Because standards set them aside for exactly this use. RFC 5737 and RFC 3849 reserve IP ranges for documentation, and RFC 2606 reserves example.com and its siblings for email. Values from those ranges cannot reach a real host or mailbox, which makes them safe in anything you publish or in a fixture that might escape into an environment that really sends mail.
What does seeded mode do?
It replaces the cryptographic source with a deterministic generator driven by a seed you choose, so the same seed and settings always produce the same output. That is useful for reproducible test fixtures and for demonstrations. It is unsuitable for anything that must be unguessable, because anyone holding the seed can regenerate the values exactly.
Can I use the generated data in production?
Synthetic records and JSON are intended for development and staging. Mixing them into production data creates records that look real and are difficult to identify and remove later. Keys, tokens and passwords generated here can be used for real accounts if you accept the environment risk described above.
One random source behind every tool
Every generator on this page draws from the same engine: crypto.getRandomValues, the cryptographically strong random source built into your browser. It is seeded from operating-system entropy and designed so that observing past output reveals nothing useful about future output.
Values are mapped onto the range each tool needs using rejection sampling rather than the remainder operator. The difference sounds academic and is not. Reducing a random number modulo an alphabet size makes the first few values slightly more likely whenever the alphabet does not divide evenly into the generator’s range. For a password or a token that is a genuine weakness, and it is entirely avoidable, so the same careful method is used everywhere — including the tools where it would not have mattered.
Sized in bytes, reported in bits
The secret-generating tools ask for entropy in bytes and report strength in bits, because those are the units that mean something. Thirty-two hexadecimal characters and thirty-two Base64 characters carry very different amounts of entropy — roughly 128 bits against 192 — so a character count is an ambiguous way to ask for a secret.
Asking in bytes removes the ambiguity: request 32 bytes and you get 256 bits whichever format you then display it in. One byte is eight bits, sixteen bytes is 128 bits, and 128 bits is the usual floor for anything that protects access.
Reserved ranges are used deliberately
The tools that imitate real-world data default to the ranges standards reserve for exactly that purpose. IP addresses come from the documentation blocks defined by RFC 5737 for IPv4 and RFC 3849 for IPv6. Email addresses in synthetic records use the example.com family reserved by RFC 2606. MAC addresses have the locally administered bit set so they cannot collide with a manufacturer’s range.
Each of these prevents a specific failure. A published example that uses a routable address points readers and scanners at a stranger’s server. A staging environment seeded with plausible addresses at real domains sends mail to people who never signed up. A generated MAC without the local bit can duplicate real hardware. Where the tools offer the unreserved alternative, they say what the risk is.
Synthetic data is labelled as synthetic
The record, JSON and user agent generators produce data that looks real and is not. Names come from fixed word lists; user agent version numbers come from plausible ranges rather than a frozen list of current releases, which would be out of date within weeks.
That distinction is stated on each tool and repeated in the exports, because synthetic data that is mistaken for real data causes problems in both directions — decisions made on invented figures, and invented records that are hard to separate from genuine ones later.
Reproducible when you need it
Every tool here offers a seeded mode. Enter any word or number as a seed and the same settings will produce the same output every time, drawn from a documented deterministic generator instead of the cryptographic source.
This matters for test fixtures. A test that fails against randomly generated data is only useful if you can reproduce the data that broke it; recording the seed alongside the test makes that possible. It is equally useful for demonstrations, where the same example needs to appear every time.
The trade-off is stated on every tool: a seeded value is predictable to anyone holding the seed. Use the cryptographic mode when the value must be unguessable, and seeded mode when reproducibility is the point.
Nothing generated here leaves your browser
All sixteen tools run entirely in the page. No generated value is uploaded, stored, logged or written into the page URL, and none of them offers a share link — a link that reconstructed a password or a token would defeat the purpose of generating it privately. Reload the page and everything is gone.
