Home / Guides / How the Web Crypto API Works
How the Web Crypto API Generates Randomness in Your Browser
Every tool on this site runs on one browser feature. Here's what it actually is, and why it's trustworthy enough to generate real cryptographic keys.
What it is
The Web Crypto API is a browser feature. Not a library you install, not something this site built. It gives JavaScript running on a page access to real cryptographic operations: generating random values, hashing, signing, and encrypting. It's a W3C standard, implemented natively by every major browser, and it runs entirely on your device. No server is involved in generating a value with it.
The two methods this site actually uses
crypto.getRandomValues()fills an array with cryptographically strong random bytes. This is the foundation for nearly every generator on this site: passwords, encryption keys, API keys, hash inputs, TOTP secrets, and random hex strings all trace back to this one method.crypto.randomUUID()is a dedicated shortcut specifically for generating version-4 UUIDs, built on the same underlying randomness source asgetRandomValues().
A related method, crypto.subtle (the SubtleCrypto interface), handles actual cryptographic operations like hashing (used in this site's Hash Generator and in UUID v5's namespace hashing) and signing (used in the TOTP and JWT tools, both of which rely on HMAC signing via crypto.subtle.sign()).
Why the randomness itself is trustworthy
The Web Crypto API specification doesn't mandate one specific algorithm. It requires browser vendors to seed their implementation from a genuine source of unpredictability, typically the operating system's own entropy source (the same category of source things like /dev/urandom draw from on Linux/macOS, or BCryptGenRandom on Windows). That's a meaningfully different guarantee from JavaScript's general-purpose Math.random(), which the specification explicitly does not require to be unpredictable, and which browsers commonly implement with a much simpler, faster, and guessable algorithm. See What Is a CSPRNG? for what that distinction means in practice, including a live demo.
One nuance worth knowing
For a value you'll use directly and non-extractably inside the Web Crypto API itself, as opposed to exporting as plain text to paste elsewhere, the specification's own guidance favors crypto.subtle.generateKey() over raw getRandomValues(), partly because generateKey() is guaranteed to run in a secure context. This site's generators export plain hex or Base64 text, which is the common reason people reach for a browser-based generator in the first place, so getRandomValues() is the right tool for that job. See the About page for the full methodology note.
Frequently asked questions
Is the Web Crypto API supported in all browsers?
Yes. Every current major browser (Chrome, Firefox, Safari, Edge) implements it, and has for years. It requires a secure context (HTTPS), which is standard for any modern website.
Can a website see the random values my browser generates?
Only if the page's own JavaScript explicitly sends that value somewhere, such as in a network request. Generating a value with crypto.getRandomValues() does not transmit it anywhere by itself; transmission would require separate code written to do so. On this site, nothing generated is ever sent to a server.
- MDN Web Docs, Crypto: getRandomValues() method, developer.mozilla.org
- MDN Web Docs, Crypto: randomUUID() method, developer.mozilla.org
- MDN Web Docs, SubtleCrypto interface, developer.mozilla.org