This random code generator makes redemption codes — coupons, vouchers, gift cards, serial numbers — in batches, in your browser. Not source code, and nothing is sent anywhere.
What is a random code generator?
A random code generator produces a batch of short, unique codes for people to redeem: a coupon on an email, a voucher on a printed card, a serial number on a box. The codes carry no meaning — they are looked up against a list you issued.
Not source code
Worth settling first, because the word is overloaded. Nothing here writes programs.
If you landed here wanting random text for a test fixture or a database seed, the random string generator is the tool. A random code generator is for the thing a customer types into a checkout box.
The three shapes codes come in
Almost every redemption code is one of three shapes, which is why the presets in this random code generator are use cases rather than styles.
- Grouped —
A7K9-P2XM-4RTV, for anything read off a card aloud. - Prefixed —
SN-8F3K-9QMT, so support can tell at a glance which batch it came from. - Numeric —
839204, for phone keypads and older point-of-sale terminals.
What a random code generator is not for
These are not passwords and not API credentials. A redemption code is short by design, because a human has to type it, and short is the opposite of what a secret needs.
For anything a machine consumes, the API key generator gives you the length that job actually needs.
Can your codes be guessed?
Why "impossible to guess" is not an answer
Nearly every random code generator says its output is practically impossible to guess. For a twelve character code that is true. For a six character code it is simply false, and the difference is not a matter of opinion.
An attacker does not need to guess a specific code. Any live one will do, which makes the number that matters the size of the code space divided by how many codes you issued.
A logarithmic comparison of how many random attempts it takes to hit a live code, assuming ten thousand codes have been issued. Six digits needs 100 attempts. Six letters and digits needs 218 thousand. Eight readable characters needs 110 million. Twelve readable characters needs 115 trillion. The first two, and marginally the third, fall inside the range a script making a hundred attempts per second covers within a day.
Reading the number above the settings
Instead of entropy, this random code generator shows how many random attempts it would take before one landed on a code you issued. Raise the quantity and the number falls; add characters and it climbs.
Under roughly ten million, a script making a hundred attempts a second finds a valid code within a day. That is where the readout turns red, and it is the only warning this random code generator gives you.
Why SAVE25 is the worst format of all
Human-chosen codes are not merely weak, they are the first thing tried. SpiderLabs documented attackers building dictionaries from the thirty most common retailer phrases and working through them. Redemption fields are usually case-insensitive, so SAVE25 andsave25 are one guess, not two.
Their write-up describes noticing a pattern of 10% OFF codes and simply trying90% OFF, which worked. A random code generator has no pattern to notice.
How long a code should be
Twelve characters from the readable set is the default here because it stays comfortable at any batch size you can generate on this page. Ten is fine for small campaigns.
Six characters is only safe when the codes are single-use, rate-limited at the checkout and few in number. Two more characters cost your customer nothing and buy a thousandfold, so let the random code generator do that work rather than your fraud rules.
Codes that survive being typed
Grouping and hyphens
People copy codes in chunks, so a random code generator should hand them over in chunks. Four characters at a time is the established size, which is why card numbers and licence keys both use it.
Crockford's Base32 spec puts it plainly: hyphens may be inserted to partition a string into manageable pieces, and are ignored when decoding. Strip separators before you look a code up, and a customer who omits them still succeeds.
Characters that get misread
The classic failures are 0 against O and 1 againstI or l. Each one becomes a support ticket saying the code does not work, which is a cost the random code generator can remove for free.
Crockford's Base32 alphabet drops four letters from the usual set of ten digits and twenty-six capitals. I and L are excluded because they are read as the digit one, O because it is read as zero, and U because leaving it out prevents a random code accidentally spelling an obscenity. What remains is a 32-symbol alphabet: 0 to 9 followed by A B C D E F G H J K M N P Q R S T V W X Y Z.
The readable set in this random code generator is exactly that alphabet. Dropping four symbols costs about a fifth of a bit per character, which no real campaign will ever notice.
The check character
Turn it on and one extra symbol is added, computed from the ones before it. A code with a typo fails that arithmetic, so you can reject it before touching your database.
It catches every single mistyped character and every swap of two neighbouring characters, which are the two mistakes people actually make. That is a property of the arithmetic rather than an estimate, and this site's tests verify it exhaustively.
What it does not do
A check character is not security. Anyone can compute a valid one, so it does nothing to stop guessing; it only filters accidents.
It also costs a character: the check symbol is derived rather than random, so a twelve character code with one enabled has the guessing resistance of eleven. The readout above accounts for that.
Generating a batch
Uniqueness within the batch
Every code is checked against the ones already made, so a batch of a thousand contains a thousand different codes. Where the format cannot produce that many, this random code generator refuses the batch rather than quietly returning a short one.
Prefixes and suffixes
A prefix makes a batch recognisable — SUMMER- tells support which campaign a code belongs to without a lookup. It is identical on every code, so it adds nothing an attacker has to guess.
Treat it as a label. The random part is what a random code generator is for, and it should be carrying the whole weight.
Export, and what happens after
Copy takes the whole list; download gives you a one-column CSV with a code header, which is the shape bulk discount importers expect.
Then this random code generator is finished. It does not issue, redeem, expire or track anything, and it keeps no record of what it produced.
Which means it cannot avoid your old codes
Nothing is stored between batches, so a second batch is drawn fresh rather than around the first. With a twelve character format an accidental overlap is remote, but deduplicate on import if you need certainty.
Frequently asked questions
How long should a coupon code be?
Long enough that guessing is pointless. Twelve characters from the readable set leaves a live code about one in a hundred trillion guesses away, even after issuing ten thousand of them. Six characters is where scripts start finding valid codes, and the readout above tells you which side of that line you are on.
What is the check character for?
It is one extra symbol derived from the rest of the code, so a mistyped code can be rejected before you look it up. It catches every single-character mistake and every swap of two neighbouring characters. Turn it on when people type codes in by hand; leave it off when codes are only ever pasted.
Why are O, I, L and U missing from the readable set?
It follows Crockford’s Base32 alphabet. I and L are dropped because they get read as 1, O because it gets read as 0, and U because leaving it out stops a random code accidentally spelling something obscene. Losing four symbols costs almost nothing and removes most support tickets about codes that "do not work".
Do the hyphens count as part of the code length?
No. Length counts only the code body, so a twelve-character code grouped in fours is fourteen characters on the page. Crockford’s spec treats hyphens as decoration to be ignored, and most redemption systems strip them, but check that yours does before printing.
Can two codes in the same batch be identical?
No. Each code is checked against the others as the batch is built, so a batch of a thousand contains a thousand distinct codes. If the format cannot produce that many distinct codes, the batch is refused rather than quietly repeated.
Can I generate a new batch that avoids my previous codes?
Not here. Nothing is stored between batches, so this random code generator has no memory of what it produced a minute ago. With a twelve-character format an accidental overlap is vanishingly unlikely, but if you need a guarantee, deduplicate against your existing list after import.
Can I import these into Shopify, WooCommerce or a gift card system?
Yes. Download the CSV and it opens in any spreadsheet as a single column with a "code" header, which is the shape most platforms expect for a bulk discount import. This tool creates the codes only; issuing, redeeming and tracking them is your platform’s job.
Does this generate random source code?
No. "Code" here means a redemption code — a coupon, voucher, gift card or serial number. If you are after random text for testing rather than something a customer types in, the random string generator is the right tool.
More free generators
Every tool here runs locally in your browser, with no account and no limits, on the same terms as this random code generator.
Password Tools
Random Generators
Keys & Secrets
Methodology
Last updated
How the codes are produced
Each character comes from crypto.getRandomValues() through rejection sampling, so every symbol in the chosen set is equally likely and Math.random() is never used anywhere in this random code generator. Codes are collected into a set as they are made, which is what guarantees a batch holds no duplicates.
How the guessability number is calculated
tries per hit = charsetrandom characters ÷ codes issued
Only the random characters count. Prefixes, suffixes, separators and the check symbol are all fixed or derived, so none of them add possibilities. The warning threshold is ten million, which is roughly what a script making a hundred attempts per second reaches in a day.
The check symbol
Crockford's optional check symbol: the code read as a base-32 number, modulo 37, written with the five extra symbols reserved for values 32 to 36.
Because 37 is prime and divides no power of 32, changing any single symbol always changes the result, and so does swapping two adjacent ones. The unit tests assert both by trying every possible case rather than citing the argument.
What this tool does not do
This random code generator does not store, issue, redeem, expire or track codes, and it cannot check a new batch against an old one. Nothing generated here is transmitted, written to storage or included in any analytics event. Closing the tab is the end of it.