What is a random string generator?
Random strings are everywhere in software: API keys, session and CSRF tokens, password-reset links, invitation and voucher codes, file names, test fixtures and database seeds. For anything security-related they must be unpredictable, which means generated from a cryptographically secure source — not from Math.random() or PHP’s rand(), whose output can be predicted after observing a few values.
This generator uses the Web Crypto API (crypto.getRandomValues()) and rejection sampling, so every character in the pool is exactly equally likely. The naive random % poolSize approach skews towards the first characters whenever the pool size does not divide 2³², a subtle bias that real-world token generators have shipped with.
The entropy figure tells you how hard a string is to guess: each bit doubles the number of possibilities. A 32-character alphanumeric string has about 190 bits — far beyond any brute-force attack. All generation happens in your browser and nothing is stored or transmitted.
How to use the Random String Generator
- Pick a preset — alphanumeric, hex, API key, URL-safe token, numeric PIN or voucher code — or set the options yourself.
- Set the length (1–1024) and how many strings you need (1–500).
- Choose the character sets, add custom characters, and optionally exclude look-alike characters or forbid repeats.
- Add a prefix or suffix such as
key_if your format needs one, then copy or download the list.
Example
Three 24-character strings using the voucher-style settings (uppercase and digits, ambiguous characters excluded):
Q7XK4M9TWZ3HRNC8JD2V6PAF
B5GYE8RW3NKT7QHZC4MXJ29D
W2TQ9MDF6KXR8BNH3ZJCV7GYHow long should a random token be?
- Session IDs and CSRF tokens: at least 128 bits — e.g. 22 URL-safe characters or 32 hex characters.
- API keys and secrets: 128–256 bits — e.g. 32–43 alphanumeric characters.
- Password-reset and invitation links: at least 128 bits, single-use and with an expiry.
- Human-typed codes (vouchers, 2FA backup codes): shorter is fine if attempts are rate-limited; exclude ambiguous characters so
0/Oand1/l/Icannot be confused.
Frequently Asked Questions
Are these strings truly random?
They come from your operating system’s cryptographically secure random number generator via the browser’s Web Crypto API. That is the same source used to generate encryption keys, and it is suitable for tokens and secrets.
What does the entropy value mean?
It is log₂ of the number of possible strings with your settings: length × log₂(pool size). 64 bits resists casual guessing, 128 bits is the standard for security tokens, and anything above that is beyond brute force.
Why exclude ambiguous characters?
In many fonts I, l and 1, or O and 0, look alike. Removing them avoids mistakes when people read or type a code — at the cost of slightly fewer bits per character.
Should I use this for passwords?
You can, but the Password Generator is designed for it, with guaranteed character classes, memorable passphrases and a strength meter.
How do I generate secure random strings in code?
In JavaScript use crypto.getRandomValues() or crypto.randomUUID(); in PHP 7+ use random_bytes() or random_int(); WordPress offers wp_generate_password( $length, false ); in Python use the secrets module, e.g. secrets.token_urlsafe(32).