Random String Generator
Build random strings from exactly the character set and length you specify.
Random String Generator tool
Duplicate characters are removed before drawing, so a character cannot be weighted by repeating it.
What this tool does
You choose the alphabet and the length; it draws each character independently from
crypto.getRandomValues() and hands back as many strings as you ask for. The
presets cover the alphabets that come up constantly — hexadecimal, alphanumeric, the URL-safe
64, plain digits, Base58 — and the field below them is editable, so an alphabet of
ACGT or of three emoji works exactly as well.
Every string is generated in this tab. Nothing is sent anywhere, which matters because the most common reason to be here is to produce something that is about to become a secret.
Common uses
- An API key or bearer token for a service you are building.
- A 32-character hex value to seed a session-signing secret in a
.envfile. - A per-user salt, or a nonce for a Content-Security-Policy header.
- Test fixtures: five hundred distinct account references in one click.
- A random subdomain or bucket suffix that will not collide with an existing one.
A short example
Alphabet 0123456789abcdef, length 32, one string:
7f3a91c0d45e28b6af10c73d95e8b2a4That is 32 × 4 = 128 bits, because each hex character carries exactly four. The same 128 bits needs only 22 characters from the URL-safe 64-character alphabet, or 20 from Base58.
Choosing an alphabet that survives the journey
The alphabet matters more than people expect, because the string has to travel. Hex is the
safest: it survives URLs, filenames, shell arguments, CSV exports and case-insensitive
comparison, at the cost of being twice as long as it needs to be. The URL-safe set (letters,
digits, - and _) is the efficient middle ground and is what Base64url
and Nano ID both use.
Base58 drops 0, O, I and l — the
characters people transcribe wrongly — which is why Bitcoin addresses use it and why it is a
good choice for anything someone might read aloud or retype off a screen. Avoid raw Base64
for identifiers that land in URLs: + and / both need escaping, and
the trailing = padding is stripped by some libraries and not others.
Worth knowing
"Possible values" in the stats above is the full keyspace, not a security claim. A short string from a big alphabet can still be guessable: eight alphanumeric characters is about 48 bits, which is fine for a URL slug and far too little for a password-reset token, where 128 bits is the sensible floor. Duplicate characters you type into the alphabet are removed before drawing — weighting a character by repeating it would quietly break the entropy figure shown above.
Frequently asked questions
Why is Math.random not good enough for a token?
Because it is predictable by construction. V8 implements Math.random() with xorshift128+, and its 128-bit internal state can be reconstructed from a short run of observed outputs, after which every past and future value falls out of the arithmetic. It is a statistical generator, never a secret one. crypto.getRandomValues() draws from the operating system’s CSPRNG instead, which is the only source this page uses.
Should I store the API key I just generated?
Store a hash of it, never the key itself. Show the plaintext once, keep its SHA-256 digest in the database, and hash each incoming key to compare. A single fast hash is the right call here, because a 128-bit random value has nothing to brute-force — unlike a human-chosen password, which needs Argon2id. Keep the first few characters in a separate column so the key stays recognisable in a UI.