Guide · Security & privacy

Secure randomness, generated where you can see it.

RandomKeygen creates passwords and secrets inside your browser. That keeps the generated value out of a server request, server log, database, or account history—and gives you a simple way to verify how it works.

Privacy & Security · 7 min read

The short version: Your browser already has a security-grade random-number generator. RandomKeygen uses it locally, formats the result for the job you choose, and shows it directly to you. Loading the website still involves normal internet traffic. The important distinction is that the generated value itself is not submitted to RandomKeygen by the generation action.

Three local steps

What happens when you click Generate:

Your browser creates random bytes. The generator asks the browser Web Crypto API for cryptographically strong random values. It does not ask our server to create them.
The page formats the result. Those bytes become the password, token, UUID, hex key, or other format you selected—all inside the open tab.
You decide where it goes. The value is displayed for you to copy. The generator does not create an account, history, or server-side copy of the result.

Where the randomness comes from

RandomKeygen uses crypto.getRandomValues(), part of the browser's Web Crypto API. It produces random bytes using a cryptographically secure pseudorandom number generator, or CSPRNG.

The browser implementation is designed to draw on the operating system's entropy source. Modern operating systems maintain that source using hardware and system events, then make secure random bytes available to applications—including your browser.

“Pseudorandom” does not mean weak. It means a carefully designed generator expands a securely seeded internal state into values that are computationally impractical to predict.

The Web Crypto standard requires getRandomValues() to return cryptographically strong random values. It is the browser primitive intended for this job.

generation-flow.js

1. Create byte array
2. Fill with Web Crypto
3. Format locally
4. Display in this tab

// No generated-value upload step

Read the Web Crypto standard ↗

Fewer places for a secret to exist

Generated in your browser:

✓ No generation request containing the value
✓ No generated-value database or account history
✓ No value waiting in a server response or application log
✓ Generation can continue after the page is loaded offline

Generated by a server:

— The server creates or receives the secret
— The value travels back to the browser
— Logging and storage must be implemented perfectly
— You must trust both delivery and server handling

More signals do not automatically mean more security

Mouse paths, typing rhythms, browser details, and similar behavioral signals are difficult to measure conservatively. They can be repetitive, automated, observed, or manipulated—and collecting them can resemble fingerprinting.

The operating system is better positioned to gather and mix appropriate entropy. RandomKeygen therefore relies on the browser's security primitive instead of building a homemade entropy pool from user behavior.

Read the IETF guidance on user-event entropy ↗

What local generation does—and does not—protect

It helps protect against

Generated values appearing in application servers, request bodies, server responses, server logs, or account histories.

It does not replace

A password manager, secrets manager, secure backup, access controls, or a key-rotation process after you copy the value.

It cannot protect

A compromised device, malicious browser extension, injected script, exposed clipboard, screen recording, or someone with access to your unlocked computer.

You do not have to take the label on faith

Open browser developer tools. Select the Network panel and clear the request list.
Generate another value. The result changes immediately without a generation response from our server.
Inspect any traffic. Normal page, CDN, prefetch, or performance requests can still occur; the generated value should not appear in their URL or payload.
Try it offline. After the page has loaded, take the browser offline and generate again.

For especially sensitive production systems: Browser generation can remove a server exposure point, but your organization may require generation inside its own infrastructure, hardware security module, or secrets manager. Many RandomKeygen tools include equivalent terminal commands for that workflow. The safest choice is the one that matches your threat model, audit requirements, and storage process—not simply the longest-looking string.