Random Number String

What this tool is used for

• Producing a digit string of exact length for a reference or an account number fixture.
• Generating numeric input to test a field that only accepts digits.
• Producing a PIN-like value for a test account.
• Filling a dataset with plausible numeric identifiers.
• Generating a code to check that leading zeros survive a round trip.

Frequently Asked Questions

How is this different from a random number?

The result is a STRING of digits, so leading zeros are preserved and the length is fixed. 0042 is a valid four-digit string but the number 42 — which is exactly why PINs, order references and zip codes must be stored as text.

Why does storing these as integers cause bugs?

Because integer storage silently strips leading zeros, so 0042 becomes 42 and no longer matches on lookup. The same mistake truncates long numeric IDs past 2^53 in JavaScript, where they lose precision entirely.

How much entropy does a digit string carry?

log2(10) ≈ 3.32 bits per digit, so a 6-digit code is only ~20 bits — about a million possibilities. That is fine for a short-lived one-time code with rate limiting, and completely inadequate as a standing secret.

Is it suitable for OTP codes?

Only with server-side rate limiting and expiry. Six digits is guessable in a million tries, so the security comes from locking out after a handful of attempts and expiring in minutes — never from the code length alone.

Are the digits uniformly distributed?

Yes — generation uses crypto.getRandomValues with rejection sampling, so no digit is favoured. A naive modulo of a random byte by 10 would make 0-5 slightly likelier, since 256 does not divide evenly by 10.

Why can a leading zero disappear?

Because anything treating the value as a number drops it — a spreadsheet import, a JSON parse into a numeric type, or a database integer column. A digit string is text that happens to look numeric, and must be stored as text throughout.

Should a generated code exclude look-alike digits?

Only if a human reads it aloud or copies it by hand, where 0/O and 1/l confusion matters — but those are letters, so a pure digit string is already safe. The real transcription risk with digits is transposition, which a check digit catches.

How does length relate to guessability?

Each digit adds only about 3.32 bits, so a six-digit code is a million possibilities — trivial to brute-force without a rate limit. That is why one-time codes are short and always paired with an attempt cap and a short expiry.

Common errors and gotchas

• Storing the value as a number, which strips leading zeros and changes the string.
• Using it as a PIN or a code where guessability matters, since digits give very little entropy per character.
• Generating a length that collides with a real format, so test data looks like production data.
• Assuming digits are safe everywhere, when a leading zero can be read as octal in some parsers.
• Treating it as random enough for a security purpose without checking the source of randomness.