How to use it
- Set the length and how many strings you need.
- Pick lowercase, uppercase, digits and symbols, or type a custom character set.
- Optionally exclude look-alike characters such as 0, O, 1 and l.
- Click Generate, then copy or download the list.
Options
- Length: 1 to 4,096 characters per string.
- How many: up to 1,000 strings per click, one per line.
- Character sets: lowercase
a–z, uppercaseA–Z, digits0–9, and symbols!@#$%^&*()-_=+[]{};:,.?/. - Exclude look-alikes: removes
0 O o 1 l I, which are easy to misread when a code is printed, read aloud or typed from a screen. - Custom character set: type any characters, and only those are used. For example
0123456789ABCDEFgives hex strings, andACDEFGHJKLMNPQRTUVWXY34679gives unambiguous voucher codes.
Below the result, the tool shows how many distinct characters were used and the entropy of each string in bits.
How secure are the strings?
The strings come from your browser's cryptographically secure random number generator (crypto.getRandomValues), the same source used for encryption keys. The tool also avoids modulo bias, a subtle flaw where some characters come up slightly more often than others, by discarding random values that would skew the distribution.
Entropy measures how hard a string is to guess: length × log2(number of possible characters).
| Characters | Length | Entropy |
|---|---|---|
| Digits only (10) | 6 | about 20 bits |
| Letters and digits (62) | 16 | about 95 bits |
| Letters and digits (62) | 24 | about 143 bits |
| Letters, digits, symbols (86) | 32 | about 206 bits |
For API keys, session tokens and other secrets, aim for at least 128 bits: for example 22 or more characters from letters and digits.
Examples of useful settings
| Purpose | Settings | Example |
|---|---|---|
| API key | 32 characters, letters and digits | kq7XbR2mTz9LwP4vNc8sYh1JdF6gUe3a |
| Voucher code | 8 characters, uppercase and digits, exclude look-alikes | K7RX4MZT |
| Numeric PIN for testing | 6 characters, digits only | 583920 |
| Hex secret | 64 characters, custom set 0123456789abcdef | 256-bit key in hex |
| Strong secret with symbols | 40 characters, all sets | for .env session secrets |
The examples above are illustrations, not values to reuse: generate your own. If a system rejects certain symbols, such as quotes or backslashes in configuration files, use a custom character set without them.
Typical uses
- Test data: fill database columns, forms and load tests with realistic random values.
- Tokens and secrets: API keys, webhook signing secrets, CSRF tokens,
.envvalues such as session secrets. - Coupon and invite codes: short uppercase codes without look-alike characters, easy to type from a printed flyer.
- Temporary file names and unique suffixes.
- Salts and nonces for development and testing.
Everything is generated locally. The strings are not sent to or stored on any server, so they are safe to use as real secrets.
Random strings vs. passwords and UUIDs
A random string is the most flexible option, but for some jobs a specialized tool fits better:
- For a password a person must type or remember, a passphrase of several random words is easier to use at the same strength. Our password generator handles that.
- For database IDs, a UUID is the standard format and every database and language understands it.
- For short codes, check the collision risk: with 6 uppercase letters and digits (36 characters) there are about 2.2 billion combinations, but by the birthday paradox you would expect a duplicate after roughly 55,000 random codes. Store issued codes and check new ones against them.
Frequently asked questions
Are these random strings secure?
Yes. They are generated with the browser's cryptographically secure random number generator, locally on your device.
How long should an API key or token be?
Aim for at least 128 bits of entropy, for example 22 or more characters from upper- and lowercase letters and digits.
How do I make codes that are easy to read?
Tick Exclude look-alikes, or use a custom set without 0, O, 1, I and l, and use uppercase letters only.
Can I generate many strings at once?
Yes, up to 1,000 per click, one per line, and download them as a text file.
Can I use my own characters?
Yes. Type them into the custom character set field and only those characters are used.
Last updated: November 12, 2026