Free Random JSON API — No Key, CORS Enabled

The Random Generator API exposes the same Web Crypto primitives used by the browser tools. It is intentionally small: one endpoint, a handful of types, and predictable JSON. Use it for prototypes, classroom demos, game servers, and automations that need a fair random value without a vendor SDK.

The service runs on Cloudflare Workers close to the request. It does not store your parameters or results. For high-value cryptographic keys, use a dedicated key-management service instead.

Quick start

Send a GET request to /api/random with a type and any options. The response is JSON.

curl "https://random-foundry.com/api/random?type=number&min=1&max=100&count=5"

{
  "ok": true,
  "type": "number",
  "values": [42, 7, 91, 15, 63],
  "meta": {
    "count": 5,
    "source": "crypto.getRandomValues",
    "generated_at": "2026-11-04T10:15:30.000Z"
  }
}

Endpoint

GET /api/random — returns JSON. All parameters are optional; unsupported values fall back to defaults or return a 400 error.

GET/api/random?type=number

Uniform integers in an inclusive range.

/api/random?type=number&min=1&max=100&count=5&unique=true

Parameter	Type	Default	Description
`min`	integer	`0`	Smallest value, inclusive.
`max`	integer	`100`	Largest value, inclusive.
`count`	integer	`1`	Number of values, 1–100.
`unique`	boolean	`false`	Draw without replacement.

GET/api/random?type=digits

A string of random decimal digits.

/api/random?type=digits&length=8&count=1

Parameter	Type	Default	Description
`length`	integer	`8`	Characters per value, 1–256.
`count`	integer	`1`	Number of values, 1–100.

GET/api/random?type=letters

Random Latin letters in lower, upper, or mixed case.

/api/random?type=letters&length=12&case=mixed&count=2

Parameter	Type	Default	Description
`length`	integer	`12`	Characters per value, 1–256.
`case`	string	`mixed`	lower, upper, or mixed.
`count`	integer	`1`	Number of values, 1–100.

GET/api/random?type=symbols

Random typographic symbols from a curated Unicode set.

/api/random?type=symbols&length=6&set=math&count=1

Parameter	Type	Default	Description
`length`	integer	`6`	Characters per value, 1–256.
`set`	string	`basic`	basic, math, currency, arrows, or all.
`count`	integer	`1`	Number of values, 1–100.

GET/api/random?type=password

A random password with configurable character sets.

/api/random?type=password&length=20&count=1&symbols=true

Parameter	Type	Default	Description
`length`	integer	`16`	Characters per password, 1–256.
`upper`	boolean	`true`	Include uppercase letters.
`lower`	boolean	`true`	Include lowercase letters.
`digits`	boolean	`true`	Include digits.
`symbols`	boolean	`true`	Include symbols.
`exclude_ambiguous`	boolean	`false`	Exclude 0/O, 1/l/I and similar.

GET/api/random?type=uuid

RFC 4122 version 4 UUIDs from crypto.randomUUID().

/api/random?type=uuid&count=3

Parameter	Type	Default	Description
`count`	integer	`1`	Number of UUIDs, 1–100.

GET/api/random?type=coin

Fair coin flips returned as heads or tails.

/api/random?type=coin&count=10

Parameter	Type	Default	Description
`count`	integer	`1`	Number of flips, 1–100.

GET/api/random?type=dice

Polyhedral dice rolls with an optional modifier.

/api/random?type=dice&sides=20&count=2&modifier=3

Parameter	Type	Default	Description
`sides`	integer	`6`	Allowed: 4, 6, 8, 10, 12, 20, or 100.
`count`	integer	`1`	Number of dice, 1–100.
`modifier`	integer	`0`	Added to the total, -1000 to 1000.

Fairness and security

Values are generated with crypto.getRandomValues() inside a Cloudflare Worker. Integer ranges use rejection sampling to avoid modulo bias. Shuffles and unique draws use the Fisher–Yates algorithm with secure indices.

Responses include Cache-Control: no-store and are not logged by the application. Cloudflare may retain standard edge logs for security and abuse prevention.

The endpoint is intended for everyday randomness, games, prototypes, and fair draws. For regulated lotteries, certified gaming, or long-lived cryptographic keys, use a system designed and audited for that purpose.

Limits and errors

count is capped at 100. length is capped at 256. The numeric range is capped to keep one request bounded.

Invalid parameters return HTTP 400 with a JSON error code and a human-readable message. Unsupported types return 400 as well.

Please cache or batch responsibly. If you need sustained high-volume traffic, build your own Worker or use a dedicated random service.

{
  "ok": false,
  "error": "invalid_parameter",
  "message": "max must be greater than or equal to min"
}

OpenAPI and CORS

The machine-readable OpenAPI 3.1 description is available at /openapi.json. The API sends Access-Control-Allow-Origin: * so browser clients can call it directly.

For CORS preflight, OPTIONS requests are supported. The API accepts GET only.