Random String Generator
Generate random strings from a custom character set.
24
Generated Output
Length: 24Characters: 0
Secure random strings
This generator draws from crypto.getRandomValues(), your platform's cryptographically secure random source — far stronger than Math.random().
Built and maintained by Meet Shah · Last updated
What this tool is used for
- Producing a random value from a specific character set a system requires.
- Generating input to fuzz a parser or a validator.
- Creating a token where you control exactly which characters may appear.
- Producing test values that avoid characters a downstream system mishandles.
- Generating a batch of distinct strings for fixtures.
Frequently Asked Questions
- How long should a random string be?
- Work in entropy, not characters. Each character contributes log2(alphabet size) bits: 62 alphanumerics give ~5.95 bits, so 22 characters reach ~131 bits — comparable to a UUIDv4. For a session token aim for 128 bits or more.
- Why exclude look-alike characters?
- Because 0/O and 1/l/I are indistinguishable in many fonts, so any string a human will read aloud, retype or copy from paper should omit them. It costs a little entropy per character and saves a great deal of support.
- Is this suitable for API keys?
- Yes — the generator uses crypto.getRandomValues, and generation happens entirely in your browser so the value is never transmitted. Store only a hash of the key on the server, exactly as you would a password.
- How does this differ from a password generator?
- Intent, not mechanism. A password generator targets human memorability and site composition rules; a random string targets machine consumption, so it favours a uniform alphabet and greater length over pronounceability.
- What is the chance of a collision?
- By the birthday bound, collisions become likely at roughly the square root of the space. A 16-character alphanumeric string has ~95 bits, so you would expect a collision after ~2^47 values — far beyond any realistic issuance rate.
- Is this suitable for generating a password?
- The randomness is, because it comes from the browser CSPRNG rather than `Math.random`. What matters more is where it goes next — a password generated in a tab and moved through the clipboard has a wider exposure than one created inside a password manager.
- Why exclude ambiguous characters?
- Because anything read aloud or retyped hits the same confusions: 0 against O, 1 against l and I. Excluding them costs a little entropy per character and removes a whole class of support call, which is why licence keys and recovery codes all do it.
- How long should a random string be for a given strength?
- Divide the target bits by log2 of the alphabet size — for 128 bits from 62 alphanumerics, about 22 characters. Choosing a length first and hoping is how tokens end up weaker than intended.
Common errors and gotchas
- Shrinking the alphabet without lengthening the string, which cuts entropy more than it looks.
- Excluding ambiguous characters and then treating the result as equally strong at the same length.
- Using it for a password where a passphrase would be both stronger and typeable.
- Assuming the output is cryptographically random when the use case requires that specifically.
- Including characters that a shell, a URL or a CSV will interpret rather than carry.
Related Generators tools
UUID Generator
Generate secure v4 UUIDs.
QR Code Generator
Create customizable QR codes and export as SVG or PNG.
Lorem Ipsum
Generate placeholder paragraphs, sentences, or word lists.
Random Hex Generator
Generate cryptographically random hexadecimal strings.
Random Number String
Generate a random string of digits of any length.
Random Color Generator
Generate random colors as HEX, RGB, and HSL.
MAC Address Generator
Generate random MAC addresses in several formats.
Nano ID Generator
Generate compact, URL-safe Nano IDs.