Random String Generator

Generate cryptographically secure random strings with full control over length, quantity, and character set. Combine lowercase, uppercase, digits, symbols, and hex, add your own characters, and drop ambiguous look-alikes with a single toggle. It is built for developers who need tokens, IDs, and test fixtures, and for anyone who needs a quick batch of unique-looking random values.

How the Generator Produces Randomness

The generator never calls Math.random. Each character is drawn from the Web Crypto API with crypto.getRandomValues, which returns cryptographically strong bytes. Picking a character by taking a byte modulo the alphabet size would bias the first few characters, so the code uses rejection sampling instead: it computes the largest multiple of the alphabet size that fits in a byte range and discards any byte above it, redrawing until the byte is valid. The chosen byte is then reduced modulo the alphabet size. The practical effect is that every character has exactly the same probability, which is what you want for tokens, nonces, and fixture data.

Worked Example: A 16-Character Token

Leave the defaults in place and you get lowercase, uppercase, and digits — a 62-character alphabet — with a length of 16. One run might return:

K7mQ2vXp9RaTZ4bH

That is 16 characters. Its entropy is 16 times log2(62), which is roughly 95 bits, far beyond what is needed for a session identifier. If you instead enable hex only, the alphabet shrinks to 16 characters, so the same 16-character length carries only 64 bits. To match the default strength with hex you would need 24 characters, since log2(16) is 4 bits per character and 95 divided by 4 rounds up to 24.

Character Sets and Entropy

The five built-in sets are combined when selected:

Set	Size	Notes
Lowercase	26	a–z
Uppercase	26	A–Z
Digits	10	0–9
Symbols	27	punctuation such as ! @ # $ % and brackets
Hex	16	0–9 and a–f

Entropy per character is the base-2 logarithm of the alphabet size, so it grows with every set you enable. Total entropy is that value multiplied by the length. That means you can trade length for alphabet breadth: a 20-character full-alphabet string and a longer hex string can reach the same strength. The tool caps each string at 1000 characters and each batch at 100 strings.

Custom Characters and Ambiguity Filtering

The custom characters field is merged into whichever sets you have checked, then the whole alphabet is deduplicated. This is useful when a downstream system allows only a narrow punctuation subset, or when you need a specific prefix character group. The exclude-ambiguous toggle removes I, l, 1, O, and 0 from that final alphabet. It is meant for values a human will read aloud or retype — referral codes, one-time codes, license keys — where confusing a capital I with a lowercase l or a zero with an O causes real support tickets.

Common Mistakes

• Expecting uniqueness. Randomness prevents predictability, not collisions. Two strings in a batch of 100 can match, especially with a small alphabet.
• Using the default for secrets without review. The default is strong, but a short hex-only string is not. Match the alphabet and length to the threat.
• Forgetting the custom field is filtered. If you type IO10 as custom characters and leave the ambiguous filter on, all four are removed and you may trigger an empty-charset error.
• Copying only one string when you needed the batch. The copy-all button joins the batch with newlines; individual copy buttons are per row.
• Treating output as stored. Nothing is saved, so copy what you need before navigating away.

Where These Strings Fit

• Session and API tokens. A 32-character full-alphabet string carries about 190 bits, which is more than enough for a bearer token in development and testing.
• Test fixtures and seeds. Generate a batch of 100 IDs at once, then paste them into a test file to exercise length and character-set validation.
• Referral and coupon codes. Turn on uppercase and digits, enable the ambiguous filter, and use a length that stays easy to dictate over the phone.
• Salt and nonce values. A hex-only string of 32 characters gives 128 bits and slots neatly into hashing libraries.
• Placeholder secrets in examples. Produce realistic-looking values for documentation without exposing anything real.

For security-sensitive work, generate with the browser’s crypto source and store the result in a secrets manager. The generator itself is the right kind of random, but a value committed to a file or pasted into a ticket stops being secret the moment it is shared. Size the string to its lifetime as well: a code that expires in five minutes needs far fewer bits than one that lives for a year.

Length and alphabet both matter, and it is easy to overspend on one while underprovisioning the other. A long string drawn from just the digits has a large total entropy, but each character is still only one of ten possibilities, so a single position is easy to guess. What protects the whole value is the total, so prefer a broad alphabet with a reasonable length over an extreme length with a narrow one. The tool’s caps exist for responsiveness: 1000 characters is the longest single string the page will build, and 100 is the largest batch it will render at once.

Related Tools

• Password Generator
• Random Number Generator
• UUID Generator
• Hash Generator