Random String Generator

This random string generator produces cryptographically secure text of any length, using whatever alphabet you choose. Everything runs in your browser, so nothing is sent anywhere.

What is a random string?

A random string is a sequence of characters drawn independently from a chosen alphabet, with no pattern connecting one position to the next. Unlike a password or a UUID, it has no required structure — you decide the length and the character set.

Random string vs password vs UUID

All three are unpredictable values, but they carry different guarantees.

A password generator guarantees coverage of the character classes you selected. A UUID has a fixed 128-bit layout that other systems can parse. A random string generator promises neither, which is exactly why it fits when you control the format yourself.

Why the character set matters

Each character contributes log₂(setSize) bits. A digit contributes 3.3 bits; an alphanumeric character contributes 5.95.

That means a smaller alphabet is not automatically weaker. Set the length accordingly and a random string generator restricted to hex reaches the same strength as one using every character.

How this random string generator works

Where the randomness comes from

This random string generator draws characters from crypto.getRandomValues(), the browser's cryptographic random source, which is fed by the operating system's entropy pool.

Math.random() is never used anywhere on this site. It is seeded and deterministic, which makes it fine for shuffling a playlist and unacceptable for anything security-adjacent.

The modulo bias problem

Getting random bytes is the easy part. Mapping them onto your alphabet without skewing the result is where most implementations quietly go wrong, and it is the one thing a random string generator has to get right.

The obvious approach is randomByte % 62. A byte holds 256 values, and 256 divided by 62 is 4 with a remainder of 8.

Those 8 leftover values land on the first eight characters, so a throughh get picked 25% more often than everything else. The output still looks random. It just is not uniform.

How rejection sampling fixes it

Instead of folding the leftover values back onto the first characters, they are thrown away and a fresh byte is drawn.

Discarding samples sounds wasteful, but the mask is sized so fewer than half are ever rejected. The cost is invisible in practice, and the random string generator ends up with an exactly uniform distribution.

Why this matters for security-sensitive values

For test data, a 25% skew is harmless. For a token or a key, it hands an attacker a head start: guesses can be ordered by likelihood instead of tried at random.

Since the same engine powers every tool here, the correction applies whether you are generating throwaway fixtures or something that guards real access.

Choosing a character set

Alphanumeric — the safe default

62 characters, no punctuation to be escaped, mangled, or rejected by a downstream system. This is where the random string generator starts, and it is the right answer when in doubt.

Hexadecimal

Hex maps cleanly onto bytes: two characters per byte, so 32 characters is exactly 16 bytes. That makes it the natural choice when a value has to line up with a specific bit length.

URL-safe

Adding - and _ to the alphanumeric set gives 64 characters that survive a URL, a filename, and a shell argument without escaping.

Custom sets and exclusions

Entering your own characters overrides the toggles entirely. Repeated characters are collapsed first, so a set of aab behaves identically to ab and no character gets double weight.

The exclusion field works the other way: it removes characters from whatever pool is active. Point the random string generator at il1Lo0O when a human will read the value aloud or copy it by hand.

How to use this random string generator

Set the length

The slider covers 1 to 1024 characters and starts at 32. The random string generator updates the entropy readout as you move it, showing both the bit count and the size of the active character set.

Pick characters

Use the presets for the common cases, or the four toggles for finer control. Anything typed into the custom field takes precedence, and the toggles grey out to make that clear.

Unique characters only

Enabling this guarantees no character repeats. Because that is only possible while the length stays within the alphabet size, the random string generator caps the length automatically and tells you the ceiling.

Generate in bulk

Set the quantity up to 100. The list can be copied in one click or downloaded as a text file, which is the fastest way to seed a test table with realistic-looking values.

What to use random strings for

Test data and fixtures

Populating a staging database with values that are obviously not real but still vary the way production data does. Running the random string generator in bulk and downloading the list covers this in one step.

Identifiers and short codes

Order references, invite codes, and internal keys where you control both ends and want a specific length. For grouped and formatted codes, the random code generator shapes the output for you.

Tokens and secrets

A long URL-safe value from a random string generator works as a session token or a webhook signing secret. For anything with a conventional format, reach for the secret key generator or the API key generator instead.

When to use a dedicated tool instead

Use the password generator when a human will store the value in a password manager, and the UUID generator when another system needs to recognise the format.

Reach for this random string generator when neither convention applies and the shape is entirely your choice.

Frequently asked questions

More free generators

Every generator here runs locally in your browser, with no account and no limits.