Random String Generator

How the Random String Generator works

Random string generator: length and entropy

A random string is the raw material behind most secrets in software: the API key a service hands out, the token in a password-reset link, the salt stored beside a hash, the nonce that makes a request unique. It is also the quickest way to make a placeholder that no real value could collide with. The two things that matter are that the characters are genuinely unpredictable and that the set they are drawn from suits where the string will be used.

Randomness. Everything here comes from crypto.getRandomValues, the browser's interface to the operating system's cryptographic generator — the same source used for TLS keys. It is not Math.random, which is seeded predictably and must never be used for secrets. Characters are selected by rejection sampling so each one is exactly as likely as any other; the naive "random number modulo alphabet size" approach quietly favours the first few characters of the alphabet, and that bias is avoided here.

Character sets. Alphanumeric (62 characters) is the general-purpose choice and gives about 5.95 bits of entropy per character. Lowercase and digits suits identifiers that will be lower-cased or used in hostnames. Hex gives 4 bits per character and matches what many libraries expect for secrets and salts — a 64-character hex string is a 256-bit key. Base64 and URL-safe base64 pack 6 bits per character; the URL-safe variant swaps + and / for - and _ so the string survives a query string or a filename. Alphanumeric and symbols adds common punctuation for maximum density. Custom lets you type any characters you like — paste an alphabet with no look-alikes, a set of emoji, or just ACGT.

How long? Think in bits, not characters. A string is unguessable when its entropy is around 128 bits, which is 22 alphanumeric characters, 32 hex characters or 22 base64 characters. The stats line beneath the output shows the entropy for your chosen length and set so you can size a token properly instead of guessing. Test data and short IDs can be much shorter; nothing here enforces a minimum.

Several at once. Set How many to generate a batch, one per line, for seeding a database or issuing a set of keys. Each string is independently random; there is no sequence to extrapolate from one to the next.

Where the output goes. Nowhere. The strings are created in your browser tab, are not sent to a server or logged, and vanish when you leave the page. Copy what you need and treat it like any other secret from that moment on.

Related tools