Cryptographically secure random data, straight from the edge.

csprng.rda.run generates random bytes with the Web Crypto CSPRNG (crypto.getRandomValues) on Cloudflare's edge network. No signup, no API key, no logging.

Try /v1/api See how it works

Powers the CSPRNG Password Generator Chrome extension.

GET /v1/api Cloudflare edge

Request

curl -sL https://csprng.rda.run/v1/api

Response

{
  "Status": 200,
  "Data": "hp7RWuKfuUHWXvAQTUEt...",
  "Time": "2025-09-13T10:30:00.000Z"
}

Generated in under 1ms

How it works

Three steps, one request

No SDK, no client library. Every response is plain JSON from a single GET request.

Choose a length

Any integer from 1 to 65,535 bytes. Defaults to 32.

Pick a format

base64, hex or password. Defaults to base64.

Call /v1/api

Read Data off the JSON response. That's the whole API.

Features

Built to be a boring, reliable primitive

A single-purpose Worker, nothing else running behind it.

Web Crypto CSPRNG

Every byte comes from crypto.getRandomValues, the platform's own cryptographically secure generator.

Runs at the edge

Executes on Cloudflare's global network, close to wherever the request comes from.

Three output formats

base64 and hex use the full byte range; password uses rejection sampling for a uniform charset.

Stateless

No logging, no persistence. Each request is generated and forgotten.

Open to any origin

CORS is wide open, so a browser extension or any site can call it directly.

Free, no signup

No API key, no account, no rate-limit games.

Parameters

Two query params, that's it

n
lengthNumber of bytes, an integer from 1 to 65,535. Defaults to 32.
f
formatbase64, hex or password. Defaults to base64.

65,535 bytes, the max length, matching crypto.getRandomValues' own per-call limit

Requesting an out-of-range length or an unknown format returns a 400 with a Message field explaining why, in the same JSON shape as a 200.

Every response carries Access-Control-Allow-Origin: *, so it can be called from a Chrome extension's own script.