Random String Generator
Create random strings for tokens, test data, coupon codes or IDs. Every character comes from your browser's cryptographic random generator with rejection sampling, so no character is more likely than another.
How to use the Random String Generator
- Pick a preset or tick the character sets you want, and add custom characters if needed.
- Set the length and quantity. Up to 10,000 strings can be created at once.
- Choose options: exclude look-alike characters, require every set, make all strings unique or add a prefix and suffix.
- Press Generate Strings and check the entropy figure to see how hard the strings are to guess.
- Copy or download the list as a text file.
Entropy by length and character set
Entropy measures how many guesses an attacker needs: a string with b bits takes up to 2b guesses. Entropy = length × log2(pool size).
| Character set | Pool size | Bits per char | 16 chars | 22 chars | 32 chars |
|---|---|---|---|---|---|
| Numeric 0–9 | 10 | 3.322 | 53.2 | 73.1 | 106.3 |
| Hex 0–9 a–f | 16 | 4.000 | 64.0 | 88.0 | 128.0 |
| Letters a–z A–Z | 52 | 5.700 | 91.2 | 125.4 | 182.4 |
| Alphanumeric | 62 | 5.954 | 95.3 | 131.0 | 190.5 |
| Base64url (A–Z a–z 0–9 - _) | 64 | 6.000 | 96.0 | 132.0 | 192.0 |
| All printable ASCII | 94 | 6.555 | 104.9 | 144.2 | 209.7 |
Why rejection sampling matters
A random 32-bit integer has 4,294,967,296 possible values. For a 62-character alphabet, 4,294,967,296 ÷ 62 leaves a remainder of 4, so with the shortcut x % 62 the first four characters would each appear once more out of every 4.29 billion draws. The bias is tiny here but grows with larger alphabets or smaller random numbers (one random byte with % 62 makes the first 8 characters 25% more likely than the rest).
This generator computes limit = 232 − (232 mod N), throws away any value at or above the limit and draws again. Every accepted value maps to exactly the same number of characters, so the output is perfectly uniform. On average fewer than one draw in a billion is rejected for typical alphabets.
Requiring one character from each set
Many systems demand "at least one digit and one uppercase letter". The tool meets this rule by drawing whole strings and rejecting those that miss a set, which keeps every valid string equally likely. The number of valid strings is counted exactly with inclusion–exclusion. Example for length 2 with uppercase (26) and digits (10): 36² − 26² − 10² = 520 valid strings, or log2(520) = 9.02 bits instead of 10.34.
Typical uses and suggested settings
| Use | Suggested setting | Entropy |
|---|---|---|
| Session ID or CSRF token | 32 alphanumeric | 190 bits |
| URL-safe token | 22–43 Base64url | 132–258 bits |
| Coupon or invite code | 8–10 uppercase + digits, no look-alikes | 40–50 bits |
| Test data / placeholder IDs | 12 lowercase hex | 48 bits |
| One-time numeric PIN | 6 digits | 19.9 bits (rate-limit attempts) |
Frequently asked questions
Are these random strings secure?
Yes. They are generated with crypto.getRandomValues, the browser's cryptographically secure random number generator, which is suitable for tokens, session IDs and secret keys. Math.random is never used.
What is modulo bias and how is it avoided?
Mapping a random 32-bit number to an alphabet with value % size makes the first characters slightly more likely whenever 2^32 is not a multiple of the alphabet size. This tool discards random numbers above the largest multiple of the alphabet size and draws again (rejection sampling), so every character has exactly the same probability.
How is entropy calculated?
For a string of length L drawn from N possible characters, entropy = L × log2(N) bits. A 32-character alphanumeric string (N = 62) has 32 × 5.954 = 190.5 bits. If you require one character from each set, the tool counts the valid strings exactly with inclusion–exclusion, which gives a slightly lower figure.
How long should a random token be?
128 bits of entropy is the usual target for secrets and session tokens: 22 alphanumeric characters, 32 hex characters or 22 Base64url characters. For short codes that people type, fewer bits are fine as long as attempts are rate-limited.
Can I make sure no two strings are the same?
Tick “All strings unique”. The generator then skips duplicates. If you ask for more strings than are possible with the chosen length and characters, it tells you instead of looping forever.
Are the strings stored or sent anywhere?
No. Everything is generated on your device and nothing is uploaded or saved, apart from your option choices, which are remembered in your browser.