Random string generator: tokens, codes and test data, free and private
A random string generator creates text from characters picked at random, such as an API token, a coupon code or a test value. To make one here, set Length (1 to 256), tick the character sets you want (a–z, A–Z, 0–9 and symbols) or type your own Custom characters, and click Generate Strings. Raise How many, up to 1,000, for a batch. Under the settings, the tool shows how many bits of randomness each string carries, so you can judge whether it is strong enough.
It runs in your browser; nothing is uploaded (you can check the Network tab in DevTools). Characters are picked with crypto.getRandomValues, the cryptographically secure generator built into browsers, with rejection sampling so no character is favoured. The page does not store or log the strings, and there is no sign-up.
For a login you have to remember, the password generator may suit you better. A standard identifier comes from the UUID generator, readable dummy text from the Lorem Ipsum generator and plain numbers from the random number generator.
Table of Use: which settings for which job
| Job | Settings | You get |
|---|---|---|
| A strong password-style string | The defaults: Length 16, a–z, A–Z and 0–9 ticked | One 16-character string, shown as about 95 bits (strong) |
| A token of 128 bits or more | Length 22 with a–z, A–Z and 0–9 | About 130 bits (very strong) |
| A hexadecimal token | Custom characters 0123456789abcdef, Length 32 | 128 bits (very strong) |
| A 6-digit numeric code | Custom characters 0123456789, Length 6 | About 19 bits (labelled weak, so only for short-lived codes) |
| Readable coupon codes | Untick a–z, tick Exclude look-alikes and No duplicate strings, Length 8, How many 100 | 100 different codes from the 31 characters left of A–Z and 0–9 |
| A string that includes symbols | Tick the symbols box, Length 16 | 88 possible characters and about 103 bits |
| Test data or file names | Length 12, How many 1000, then Download .txt | random-strings.txt with one string per line |
| A string from your own alphabet | Custom characters such as ABCDEF | Strings made only of those characters; repeats in the list are ignored |
Features
- Length 1 to 256 and 1 to 1,000 strings per click. Out-of-range values show a message that names the allowed range.
- Four character sets: a–z, A–Z, 0–9 and 26 symbols (
!@#$%^&*()_+-=[]{}|;:,.<>?). Letters and digits are on by default; symbols are off. - Custom characters replace the sets. Duplicates are ignored, whole emoji and accented letters are kept intact, and the count of distinct characters is shown.
- Exclude look-alikes removes i, I, l, 1, L, |, o, O and 0, from the sets or from your custom characters.
- No duplicate strings with an exact check of how many different strings are possible.
- A bits-of-randomness line with a plain label: weak, reasonable, strong or very strong.
- Copy and download. Copy each string, Copy all, or Download .txt (random-strings.txt, one string per line).
The arithmetic behind the bits line:
- Bits = Length × log2(number of possible characters). Letters and digits (62) give 5.95 bits each, adding the symbols (88) gives 6.46, hex (16) gives 4 and digits (10) give 3.32.
- Possible strings = charactersLength. The No duplicate strings check compares this with How many.
- Length for 128 bits = 128 ÷ bits per character, rounded up: 22 for 62 characters, 20 for 88, 32 for hex and 39 for digits.
If you store tokens in a database, keep a hash rather than the token itself; the SHA-256 hash generator shows what one looks like. To hand a code to a phone, turn it into a scannable image with the QR code generator.
How to generate a random string, step by step
- Set Length (1–256) and How many (1–1,000).
- Under Character sets, tick a–z, A–Z, 0–9 and the symbols you need, or type your own in Custom characters (replace the sets above).
- Tick Exclude look-alikes if people will read or type the string, and No duplicate strings if every string in a batch must differ.
- Check the line under the options: it gives the number of possible characters and the bits of randomness.
- Click Generate Strings, or press Enter in a field.
- Copy one string with its clipboard button, use Copy all, or click Download .txt.
To check the length of a result, paste it into the character counter. To confirm that codes match a pattern such as eight capital letters and digits, try them in the regex tester, and to clean a pasted list use remove duplicate lines.
Who can use it
- Developers making API keys, session tokens, invite codes, file names and nonces for projects and tests.
- Testers and database owners who need up to 1,000 distinct values for fixtures and demos.
- Shop owners and event organisers printing coupon, voucher or reference codes that are easy to read aloud.
- Administrators setting a one-off shared secret or a Wi-Fi key.
- Students exploring how length and alphabet size change guessing difficulty.
FAQs
Are the strings secure enough for passwords and API tokens?
Each character is chosen with crypto.getRandomValues, your browser's cryptographically secure generator, using rejection sampling so every character is equally likely. How strong a string is then depends on its length and character set. The tool shows the bits of randomness per string and labels 80 bits or more as strong and 128 bits or more as very strong.
How do I make a hexadecimal or numeric-only string?
Type the characters you want into Custom characters: 0123456789abcdef gives lowercase hex and 0123456789 gives a numeric code. The custom set replaces the checkboxes, and repeated characters are ignored so each one has the same chance. A 32-character hex string carries 128 bits; a 6-digit code carries only about 19, so use it for short-lived codes.
What does Exclude look-alikes remove?
It removes characters that are easy to confuse when a string is read aloud, printed or typed by hand: lowercase i, l and o, uppercase I, L and O, the digits 1 and 0, and the vertical bar |. This slightly reduces the randomness per character, and the bits figure takes that into account because it counts the characters that remain.
How long should a random token or API key be?
A common target is 128 bits. Divide 128 by the bits per character, then round up: 22 characters from a–z, A–Z and 0–9, 20 characters when the 26 symbols are added, 32 hexadecimal characters, or 39 digits. A 16-character string from letters and digits carries about 95 bits. Longer is stronger, and the bits line updates as you change the settings.
Can I avoid duplicate strings?
Yes. Tick "No duplicate strings" and every string in the batch is different. If the length and character set cannot produce as many different strings as you asked for, for example 9 strings of length 3 from just a and b, where only 8 exist, the tool tells you how many are possible instead of returning a short list.
Can I use emoji or accented letters in the character set?
Yes. Custom characters are split into whole characters as you see them, so emoji, including skin-tone variants, and accented letters are never broken into invalid pieces. Each distinct character counts once and has the same chance of being picked. A space you type is kept as a character.
Is anything sent to a server?
No. The strings are generated in your browser and are not uploaded, logged or stored by this page. You can confirm it in the Network tab of your browser DevTools while you generate. Copy each string with its own button, use Copy all, or download a .txt file with one string per line. Anyone who can see your screen or clipboard can still read the result.
Is a random string the same as a UUID?
No. A UUID is a standard 128-bit identifier written in a fixed layout of 36 characters, while this tool makes strings of any length from any characters you choose. If a system asks for a UUID, use the UUID generator. If it only needs an unguessable code, key or reference of your own design, a random string is the more flexible choice.