Random String Generator

This free online random string generator creates random strings and tokens of any length, using a cryptographically strong source. Choose which character sets to include — lowercase, uppercase, digits, and symbols — optionally drop confusing look-alike characters, and generate many at once. Everything runs in your browser with no upload.

How to use

1. Set the length and how many strings you need.
2. Toggle the character sets (a–z, A–Z, 0–9, symbols).
3. Optionally exclude look-alikes, then click Generate and copy.

How long is long enough

Length only means something in combination with the alphabet you drew from. What actually matters is entropy — the number of possibilities an attacker would have to work through — and the working target for anything acting as a secret is 128 bits.

• Full alphanumeric (62 symbols): about 5.95 bits per character, so 22 characters reaches 131 bits.
• Lowercase and digits only (36 symbols): about 5.17 bits, so you need 25 characters.
• Excluding look-alikes (57 symbols): 5.83 bits, so 22 characters still clears 128.

Below roughly 16 characters, a token stops being meaningfully unguessable no matter which alphabet it uses. Above about 32 there is no practical gain — you are protecting against an attack that already cannot finish.

Random for machines versus random for people

These are different requirements and the difference is worth being deliberate about. A token that only ever moves between systems should use the widest alphabet available, because nobody will ever mistype it. A code that a human reads aloud, copies off a screen, or types from a printed card should drop the look-alike characters — i, l, 1, O and 0 — since a single misread turns a valid code into a support ticket.

The entropy cost of that choice is smaller than people expect: removing five ambiguous symbols costs about 0.12 bits per character, so a 22-character token falls from roughly 131 bits to 128. That is a trade worth making for invite codes, licence keys, and voucher numbers, and a pointless one for machine-to-machine credentials.

Where the randomness comes from

Strings are generated with the browser's Web Crypto API — a cryptographically secure source, unlike Math.random(), which is predictable and unsuitable for anything secret. Characters are selected using rejection sampling so every symbol in your chosen alphabet is equally likely; the naive modulo approach quietly biases the first few characters of the set, weakening the token in a way nothing visible would reveal.

There is a Math.random() fallback for environments with no Web Crypto at all, which in practice means none — every browser released in the last decade provides it. If you are generating a real credential in an unusual environment and cannot confirm which path ran, generate it with a server-side tool instead.

Generation happens entirely on your device and nothing is transmitted or stored. Even so, a secret that has been displayed in a browser window is best treated as a value to rotate later rather than a permanent credential.

Common uses

Creating API keys and access tokens, generating test data and unique identifiers in bulk, seeding coupon and invite codes, and producing one-off secrets for development configuration. For a single memorable human password the password generator is the better fit, and where you need a standardised globally unique identifier rather than an arbitrary string, use the UUID generator.