Random String Generator
Secure random strings with custom character sets.
🔒 100% client-side — strings are generated with crypto.getRandomValues and never stored
Character sets
Results
Generate cryptographically secure random strings with full control over length, quantity, and character sets. Combine lowercase, uppercase, digits, symbols, and hex, add your own custom characters, and drop ambiguous look-alikes with one toggle. It is built for developers who need tokens, IDs, and test fixtures — and for anyone who needs a quick batch of unique random strings.
How to Use
- Set length and count: Choose how long each string is and how many to generate (1–100).
- Pick character sets: Toggle lowercase, uppercase, digits, symbols, or hex — or type your own custom characters.
- Exclude ambiguous characters: Optionally remove I, l, 1, O, 0 for human-friendly output.
- Generate and copy: Click generate, then copy any single string or copy them all at once.
Features
- Cryptographically secure randomness via crypto.getRandomValues with rejection sampling — never Math.random
- Five built-in character sets plus a free-form custom characters field
- Exclude-ambiguous toggle for strings people need to read or retype
- Batch generation of up to 100 strings, each up to 1000 characters
- One-click copy per string and copy-all for the whole batch
- 100% client-side — nothing is uploaded or stored
Why Rejection Sampling Matters
The naive way to pick a random character is Math.floor(Math.random() * charset.length), which has two problems: Math.random is not cryptographically secure, and taking a random byte modulo the alphabet size skews the distribution toward the first few characters. This generator draws bytes from the Web Crypto API and rejects any byte that would fall outside an even multiple of the alphabet size, so every character has exactly the same probability. The result is output you can safely use for session tokens, nonce values, and fixture data without worrying about bias or predictability.
Use Cases
- API tokens and keys: Generate random secrets and bearer tokens for development.
- Test fixtures: Produce batches of unique IDs, slugs, and codes for unit tests.
- Coupon and referral codes: Exclude ambiguous characters for codes users must type.
- Hex values: Generate random hex strings for colors, hashes, or identifiers.
- Temporary passwords: Combine all character sets for high-entropy one-time credentials.
Tips for Better Random Strings
Match the character set to the consumer: machines are happy with full alphanumeric plus symbols, but humans are not — enable the ambiguous-character filter whenever a string will be spoken or typed. Entropy scales with both length and alphabet size, so a 16-character string from a 62-character alphabet already offers about 95 bits. When you need hex specifically, use the hex toggle instead of typing characters by hand to avoid typos in the alphabet. And remember that uniqueness is not guaranteed by randomness — if you need collision-free IDs across a large system, use a UUID generator instead.
Related Tools
Frequently Asked Questions
Are the generated strings truly random?
Yes. The generator uses crypto.getRandomValues, the browser's cryptographically secure random number generator, with rejection sampling to avoid modulo bias. It never falls back to Math.random, so the output is suitable for tokens, IDs, and test data.
What does the exclude ambiguous characters option do?
It removes visually confusing characters — I, l, 1, O, and 0 — from the character set. This is useful when strings will be read or typed by humans, such as referral codes or license keys.
What is the difference between the hex option and the other character sets?
Hex restricts output to the 16 characters 0-9 and a-f, which is the standard alphabet for hashes, tokens, and color codes. The other sets (lowercase, uppercase, digits, symbols) can be freely combined, and custom characters are merged in as well.
Can I use my own characters?
Yes. Type any characters into the custom characters field and they are merged with the selected sets. Duplicates are removed automatically, so combining hex with digits does not skew the distribution.
Is it safe to generate secrets here?
Everything runs entirely in your browser — nothing is sent over the network or stored. The randomness source is the same Web Crypto API used by password managers. For long-lived production secrets, prefer a dedicated secrets manager.
What are the length and count limits?
Each string can be 1 to 1000 characters long, and you can generate 1 to 100 strings per click. These limits keep the page responsive while covering virtually every practical use case.