Random String Generator

Need random strings for test data, tokens, invite codes, or placeholder content? This Random String Generator creates cryptographically random alphanumeric strings right in your browser no data ever leaves your device. Pick a length from 1 to 128, choose how many strings you need (1–100), and select the exact characters they may contain.

Generate a batch in 4 steps

The control panel sits on the left. Set Length per string with the slider or the number box 12 is the default, but tokens often use 16, 32, or 64. Set Quantity to the number of strings you need; 5 is the starting value, and the list will scroll when you ask for 20 or more. Choose character sets below or type a Custom alphabet to override them. The right-hand result card updates live as you change any setting use Regenerate in the result header when you want a fresh batch with the same settings.

Example: with Length 8, Quantity 3, and Alphanumeric (A–Z, a–z, 0–9) you might see kF7mQ2xL, 9tR2bH4p, L8vN1qW6. Change any control and every row updates instantly, or click Regenerate for a fresh batch with the same settings each character is drawn independently with crypto.getRandomValues().

Character sets and presets

Four checkboxes build the pool when Custom alphabet is empty: Lowercase a–z (26), Uppercase A–Z (26), Numbers 0–9 (10), and Symbols !@#$%^&*()_+-=[]{}|;:,.? (26). The defaults are lower + upper + numbers for a 62-character alphanumeric pool the most common choice for codes and IDs. Turn on Symbols for an 88-character pool, or turn off sets you do not want.

Typing anything into Custom alphabet replaces the checkboxes entirely. For example, enter ABCDEF0123456789 for uppercase hex, 0123456789abcdef for lowercase hex, or ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_ for URL-safe tokens (the classic Base64URL alphabet without + or /). Duplicates are removed automatically so the randomness stays uniform.

Seven Quick presets above the sets do the same in one click: Alphanumeric, Letters only, Numbers only, Hex (a–f), Hex (A–F), URL-safe, and All chars. Presets highlight when active, and editing the sets or the custom field clears the highlight so you always know what is driving the pool.

Filters that prevent mistakes

Avoid ambiguous strips 0 O o 1 l I the six look-alikes that get confused in printed codes, invoices, and hand-written labels. With Alphanumeric, the pool drops from 62 to 56 after the filter; with a custom 01 alphabet the tool warns you instead of returning an empty result.

Ensure each set appears (on by default) guarantees every checked set contributes at least one character, then shuffles the result. A 6-character string with lower + numbers and this box ticked can never come back all-letters when a site requires a digit. If the length is shorter than the number of checked sets, the tool asks you to increase length instead of silently breaking the promise.

Unique strings forces every row in the batch to be different. For a pool of 62 and length 4, there are 14 million combinations, so 100 unique strings are trivial; for a tiny custom alphabet like AB with length 2 there are only 4 combinations, and asking for 5 unique strings triggers a clear error rather than looping forever.

Reading the results and stats

Each generated string appears as a numbered row with its own Copy button, and the header offers Regenerate for a fresh batch plus Copy all (newline-separated) and Download in TXT, CSV, or JSON. The stats strip shows Quantity, Length, Pool size, Entropy per string, estimated crack time at 10 billion guesses per second, and Total characters.

Entropy is length × log2(poolSize). An 8-character alphanumeric string carries 8 × 5.95 ≈ 47.6 bits and sits in the Fair band; bumping it to 12 characters pushes it to 71.4 bits (Strong), and 16 characters reach 95.2 bits (Very strong). The strength meter follows those bands: Weak <45, Fair 45–64, Strong 65–89, Very strong ≥90. Crack time scales with entropy those same three examples go from years to centuries to millennia at offline guessing speeds.

Why local randomness matters

Every character is picked with crypto.getRandomValues(), the browser API backed by the OS secure random source. The picker uses rejection sampling, so no character is favored because of modulo bias. Nothing you generate is sent to a server, stored, or visible to the site owner. That is the same guarantee made by 1Password, Bitwarden, and the OS key generators only your device sees the output.

Common uses

Use Alphanumeric, length 8–10 for short invite codes and test usernames. URL-safe, length 21+ makes unguessable share tokens and password-reset links. Hex, length 32 produces API keys, request IDs, and color-agnostic hashes. Numeric, length 6 yields one-time passcodes. All chars, length 16+ is ideal when you need maximum entropy for temporary secrets, just before handing them to a password manager.

Tips

Keep a generated batch private do not paste untrusted random strings into online validators. If you need to guarantee URL safety, avoid the Symbols set and use the URL-safe preset explicitly; it contains only letters, digits, hyphen, and underscore. For fixed-width exports, download as TXT; for spreadsheet imports, choose CSV (values are quoted); for feeding a script, use JSON array. When you need a single token quickly, set Quantity to 1 the stats and copy button work the same.