Generate a cryptographically strong random string
Installations
npm install crypto-random-string
Developer Guide
Typescript
Yes
Module System
ESM
Min. Node Version
>=14.16
Node Version
16.15.0
NPM Version
8.3.2
Releases
Contributors
Unable to fetch Contributors
Languages
JavaScript (95.02%)
TypeScript (4.98%)
Developer
sindresorhus
Download Statistics
Total Downloads
3,666,880,187
Last Day
2,942,537
Last Week
13,401,082
Last Month
61,016,072
Last Year
836,335,017
GitHub Statistics
571 Stars
33 Commits
45 Forks
9 Watching
1 Branches
8 Contributors
Bundle Size
2.37 kB
Minified
1.00 kB
Minified + Gzipped
Sponsor this package
Package Meta Information
Latest Version
5.0.0
Package Id
crypto-random-string@5.0.0
Unpacked Size
17.27 kB
Size
5.17 kB
File Count
7
NPM Version
8.3.2
Node Version
16.15.0
Total Downloads
Cumulative downloads
Total Downloads
3,666,880,187
Last day
-7%
2,942,537
Compared to previous day
Last week
-16.9%
13,401,082
Compared to previous week
Last month
4%
61,016,072
Compared to previous month
Last year
11.9%
836,335,017
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
crypto-random-string
Generate a cryptographically strong random string
Can be useful for creating an identifier, slug, salt, PIN code, fixture, etc.
Works in Node.js and browsers.
Install
1npm install crypto-random-string
Usage
1import cryptoRandomString from 'crypto-random-string';
2
3cryptoRandomString({length: 10});
4//=> '2cf05d94db'
5
6cryptoRandomString({length: 10, type: 'base64'});
7//=> 'YMiMbaQl6I'
8
9cryptoRandomString({length: 10, type: 'url-safe'});
10//=> 'YN-tqc8pOw'
11
12cryptoRandomString({length: 10, type: 'numeric'});
13//=> '8314659141'
14
15cryptoRandomString({length: 6, type: 'distinguishable'});
16//=> 'CDEHKM'
17
18cryptoRandomString({length: 10, type: 'ascii-printable'});
19//=> '`#Rt8$IK>B'
20
21cryptoRandomString({length: 10, type: 'alphanumeric'});
22//=> 'DMuKL8YtE7'
23
24cryptoRandomString({length: 10, characters: 'abc'});
25//=> 'abaaccabac'
API
cryptoRandomString(options)
Returns a randomized string. Hex by default.
cryptoRandomStringAsync(options)
Returns a promise which resolves to a randomized string. Hex by default.
For most use-cases, there's really no good reason to use this async version. From the Node.js docs:
The
crypto.randomBytes()
method will not complete until there is sufficient entropy available. This should normally never take longer than a few milliseconds. The only time when generating the random bytes may conceivably block for a longer period of time is right after boot, when the whole system is still low on entropy.
In general, anything async comes with some overhead on it's own.
1import {cryptoRandomStringAsync} from 'crypto-random-string'; 2 3await cryptoRandomStringAsync({length: 10}); 4//=> '2cf05d94db'
options
Type: object
length
Required
Type: number
Length of the returned string.
type
Type: string
Default: 'hex'
Values: 'hex' | 'base64' | 'url-safe' | 'numeric' | 'distinguishable' | 'ascii-printable' | 'alphanumeric'
Use only characters from a predefined set of allowed characters.
Cannot be set at the same time as the characters
option.
The distinguishable
set contains only uppercase characters that are not easily confused: CDEHKMPRTUWXY012458
. It can be useful if you need to print out a short string that you'd like users to read and type back in with minimal errors. For example, reading a code off of a screen that needs to be typed into a phone to connect two devices.
The ascii-printable
set contains all printable ASCII characters: !"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~
Useful for generating passwords where all possible ASCII characters should be used.
The alphanumeric
set contains uppercase letters, lowercase letters, and digits: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
. Useful for generating nonce values.
characters
Type: string
Minimum length: 1
Maximum length: 65536
Use only characters from a custom set of allowed characters.
Cannot be set at the same time as the type
option.
Related
- random-int - Generate a random integer
- random-float - Generate a random float
- random-item - Get a random item from an array
- random-boolean - Get a random boolean
- random-obj-key - Get a random key from an object
- random-obj-prop - Get a random property from an object
- unique-random - Generate random numbers that are consecutively unique
Tidelift helps make open source sustainable for maintainers while giving companies
assurances about security, maintenance, and licensing for their dependencies.
![Empty State](/_next/static/media/empty.e5fae2e5.png)
No vulnerabilities found.
Reason
no binaries found in the repo
Reason
security policy file detected
Details
- Info: security policy file detected: .github/security.md:1
- Info: Found linked content: .github/security.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: .github/security.md:1
- Info: Found text in security policy: .github/security.md:1
Reason
no dangerous workflow patterns detected
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
- Info: project has a license file: license:0
- Info: FSF or OSI recognized license: MIT License: license:0
Reason
Found 14/30 approved changesets -- score normalized to 4
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/main.yml:1
- Info: no jobLevel write permissions found
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/sindresorhus/crypto-random-string/main.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/main.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/sindresorhus/crypto-random-string/main.yml/main?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/main.yml:21
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'main'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 14 are checked with a SAST tool
Score
4.4
/10
Last Scanned on 2025-01-20
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn MoreOther packages similar to crypto-random-string
@types/crypto-random-string
Stub TypeScript definitions entry for crypto-random-string, which provides its own types definitions
crypto-random-hex
Get a, cryptographically strong, string of random hexadecimal characters.
crypto-random-string-es5
Generate a cryptographically strong random string
crypto-random-string-with-promisify-polyfill
Generate a cryptographically strong random string