Search tools...
utility-tools

Random Generator Guide: Numbers, Strings, Colors, Dice & UUIDs Online (2026)

Generate random numbers, strings, passwords, colors, UUIDs, and dice rolls. Understand true vs pseudo-random, cryptographic randomness, and practical use cases for developers, gamers, and creators.

9 min readUpdated April 9, 2026Utility, Random, Developer, Games

A random generator produces unpredictable values — numbers, strings, colors, or dice rolls — for decisions, games, testing, security, and creative inspiration. But not all randomness is equal: using the wrong type of random generation can create security vulnerabilities or unfair outcomes.

This guide covers the three types of randomness (pseudo, cryptographic, true), common generation scenarios with ranges, developer use cases for UUIDs and test data, fairness/bias pitfalls, and code examples for correct random generation.

Free Tool

Generate Random Values Instantly — Numbers, Strings, UUIDs, Dice

All generation types in one tool. CSPRNG for passwords and tokens. 100% browser-based.

Open Random Generator →

Three Types of Random Generation

TypeHow It WorksSpeedUse ForNOT For
Pseudo-random (PRNG)Algorithm from seed valueVery fastGames, simulations, UI shufflesPasswords, tokens, crypto
Cryptographic (CSPRNG)OS entropy (hardware noise, timing)FastPasswords, API keys, tokens, encryptionNothing — safe for all uses
True random (TRNG)Physical phenomena (radioactive decay, atmospheric noise)SlowLotteries, scientific research, key generationHigh-throughput needs
Critical Security Rule

Math.random() is PRNG — predictable if the seed is known. NEVER use it for passwords, tokens, session IDs, or any security-sensitive purpose. Use crypto.getRandomValues() (browser) or crypto.randomBytes() (Node.js) instead. ToolsArena uses CSPRNG for all security-related generation.

Random Number Generation: Ranges & Common Scenarios

ScenarioRangeExampleMethod
Coin flip0-1 or 1-20=Heads, 1=TailsPRNG fine
Standard dice (D6)1-6Board games, D&DPRNG fine
D20 (tabletop RPG)1-20Dungeons & DragonsPRNG fine
Playing card1-52Card gamesPRNG fine
Lottery (India Lotto)1-49, pick 6Must be truly randomTRNG required
Percentage chance1-100Drop rates, A/B testsPRNG fine
PIN code0000-9999ATM, app lockCSPRNG required
OTP000000-9999992FA codesCSPRNG required
Formula for Any Range

JavaScript: Math.floor(Math.random() * (max - min + 1)) + min
For 1-6: Math.floor(Math.random() * 6) + 1
For CSPRNG: crypto.getRandomValues(new Uint32Array(1))[0] % (max - min + 1) + min

Random String & Password Generation

Character Sets

SetCharactersCountUse Case
Lowercasea-z26URL slugs, simple IDs
Alphanumerica-z, A-Z, 0-962Tokens, short URLs
Full ASCIIa-z, A-Z, 0-9, symbols95Passwords
Hex0-9, a-f16Colors, hashes, keys

Entropy by Length

LengthAlphanumeric (62)Full ASCII (95)
8 chars47.6 bits52.6 bits
12 chars71.5 bits78.8 bits
16 chars95.3 bits105.1 bits
32 chars190.5 bits210.2 bits

For passwords: 12+ characters from full ASCII set (78+ bits entropy). For API tokens: 32+ alphanumeric characters (190+ bits).

UUID Generation: When & Why

UUID v4 = 122 random bits = 5.3 × 1036 possible values.

Collision Probability

Generating 1 billion UUIDs per second for 100 years: probability of a single collision ≈ 0.00000000006%. For all practical purposes: zero.

When to Use UUIDs

  • Database primary keys — no central counter needed, safe for distributed systems
  • Session tokens — unguessable identifiers
  • File names — unique upload filenames, no collision with existing files
  • Idempotency keys — prevent duplicate API operations
  • Event tracking — unique IDs for analytics events

UUID Format

550e8400-e29b-41d4-a716-446655440000
^^^^^^^^-^^^^-4^^^-[89ab]^^^-^^^^^^^^^^^^
         (v4 marker) (variant)
UUID v4 vs v7

UUID v7 (2024+) embeds a timestamp, making it sortable by creation time — better for database indexes. UUID v4 is purely random. For new projects, consider v7 if your database benefits from sorted keys (PostgreSQL, most SQL databases).

Random Generation for Developers

Test Data Generation

  • Load testing — Random user profiles, addresses, transactions for API stress tests
  • UI testing — Random string lengths to test layout overflow, edge cases
  • Database seeding — Realistic but randomized data for development environments
  • Fuzz testing — Random inputs to find crashes and security vulnerabilities

Code Examples

// JavaScript — random integer in range
const randInt = (min, max) => Math.floor(Math.random() * (max - min + 1)) + min;

// JavaScript — cryptographic random string
const randString = (len) => {
  const arr = crypto.getRandomValues(new Uint8Array(len));
  return Array.from(arr, b => b.toString(36).padStart(2, '0')).join('').slice(0, len);
};

// Python — random choice from list
import random
random.choice(['red', 'blue', 'green'])

// Python — cryptographic token
import secrets
secrets.token_urlsafe(32)  # 32-byte URL-safe token

Fairness, Bias & Common Mistakes

Modulo Bias

Mapping a large range to a smaller one using modulo (%) creates slight bias. Example: rand() % 6 where rand() returns 0-7 gives 0 and 1 a higher probability (2/8) than 2-5 (1/8). Modern libraries handle this — but raw modulo on crypto random bytes has this issue.

Fisher-Yates Shuffle

The only correct way to shuffle an array. array.sort(() => Math.random() - 0.5) is biased — some permutations are more likely than others. Use Fisher-Yates:

for (let i = arr.length - 1; i > 0; i--) {
  const j = Math.floor(Math.random() * (i + 1));
  [arr[i], arr[j]] = [arr[j], arr[i]];
}

Common Mistakes

  • Using Math.random() for security — predictable, not cryptographic
  • Same seed in production — reproducible sequences are exploitable
  • Expecting no streaks — 5 heads in a row is normal randomness, not a bug
  • Small sample conclusions — 10 rolls averaging 4.2 instead of 3.5 does not mean the generator is biased

How to Use the Tool (Step by Step)

  1. 1

    Open the Random Generator

    Navigate to the tool on ToolsArena — no signup needed.

  2. 2

    Choose Generation Type

    Select number, string, password, color, UUID, or dice roll.

  3. 3

    Set Parameters

    Define range (min-max), length, character set, or count of results.

  4. 4

    Generate

    Click generate and see results instantly.

  5. 5

    Copy

    Copy individual results or the entire batch to your clipboard.

Frequently Asked Questions

Is Math.random() truly random?+

No. Math.random() is pseudo-random (PRNG) — algorithm-based and deterministic from a seed. It is fine for games, UI animations, and non-security purposes. For passwords, tokens, and encryption, use crypto.getRandomValues() which is cryptographically secure (CSPRNG).

What is a UUID and when should I use one?+

UUID (Universally Unique Identifier) v4 has 122 random bits — collision probability is effectively zero even generating billions. Use for database primary keys, session tokens, file names, idempotency keys, and any case where you need a unique ID without a central counter.

How do I generate a random number in a specific range?+

JavaScript formula: Math.floor(Math.random() * (max - min + 1)) + min. For a dice roll (1-6): Math.floor(Math.random() * 6) + 1. For cryptographic quality, replace Math.random() with crypto.getRandomValues().

Can random generators be biased?+

Yes, if poorly implemented. Modulo bias occurs when mapping a larger range to a smaller one unevenly. Also, using array.sort(() => Math.random() - 0.5) for shuffling produces biased results. Use Fisher-Yates shuffle and proper range mapping for unbiased output.

What is the difference between PRNG and CSPRNG?+

PRNG (Pseudo-Random Number Generator) is algorithm-based — fast but predictable if the seed is known. CSPRNG (Cryptographically Secure PRNG) uses OS entropy sources — unpredictable even if the algorithm is known. CSPRNG is safe for all purposes; PRNG is only safe for non-security uses.

How long should a random API token be?+

32 characters alphanumeric (190 bits entropy) is the minimum for API tokens. 64 characters provides ample margin. Always use CSPRNG generation (not Math.random()). In Node.js: crypto.randomBytes(32).toString('hex') gives a 64-character hex token.

Is this tool free and private?+

Yes. All random generation happens in your browser using JavaScript. No values are sent to any server or stored anywhere.

Free — No Signup Required

Generate Random Values Instantly — Numbers, Strings, UUIDs, Dice

All generation types in one tool. CSPRNG for passwords and tokens. 100% browser-based.

Open Random Generator →

Related Guides