Random String Generator

Create secure random strings

Use this tool to generate API keys for development, test passwords, coupon codes, sample IDs or fixture data. Set the length up to 4096 characters and choose the character types. Then generate up to 1000 values at once and copy or download them. Each string comes from the browser's cryptographic random generator, and is unbiased across your chosen characters. Nothing is sent to a server.

The label above the output shows approximately how many bits of entropy each string has, so you can judge its strength at a glance.

How strong is a random string?

Entropy is the number of guesses an attacker would need, expressed as a power of two. It is worked out as length multiplied by the base-2 logarithm of the alphabet size. Length makes the largest difference, as each extra character multiplies the total possibilities.

Digits only, 6 characters          ~20 bits   (weak, one-time codes only)
a-z, A-Z, 0-9, 12 characters       ~71 bits   (good for most passwords)
a-z, A-Z, 0-9, 24 characters       ~143 bits  (strong keys and tokens)
Hex, 32 characters                 128 bits   (common token size)

Choosing a character set

• Use a-z, A-Z and 0-9 for strings going into URLs, headers and config files, since none of them need escaping.
• Add symbols for passwords when a site's rules require them, but watch for characters like quotes and $ in shell scripts.
• Turn on Exclude look-alikes for codes people will read or type, because O and 0 or l and 1 are easily confused.
• Use Extra characters to add your own, for example to test how an app handles äöü.

Using random values in your own code

For secrets in production, generate values on the server with your platform's secure generator, not in a web page. Do not use Math.random(), rand() or similar functions for anything security-related, because their output can be predicted. A short example of secure generation in common environments follows.

openssl rand -base64 32                    # Shell
crypto.randomBytes(32).toString("hex")     // Node.js
secrets.token_urlsafe(32)                  # Python
bin2hex(random_bytes(32))                  // PHP

Frequently Asked Questions

Are these strings truly random?

They use crypto.getRandomValues, a cryptographically secure generator built into the browser. Rejection sampling avoids bias toward some characters.

How long should a password be?

Sixteen or more random characters is a sensible target, kept in a password manager. Length matters more than unusual symbols.

Can I get unique values in a bulk list?

Each string is generated independently. Duplicates are extremely unlikely for long strings, but they can appear for short ones with few characters, so remove them if uniqueness matters.

Does the site store what I generate?

No. The values exist only in your browser tab until you copy them or close the page.