Random String Generator

Pick a format and get the string, that is the whole idea. Most random string generators drop four checkboxes in front of you and leave you to work out which combination makes a URL-safe token, or a proper hex key, or a base62 id, where here the presets are named after the job. Click Hex, or URL-safe token, or API key, and it sets the length and the exact alphabet for that job in one tap. Then it generates a fresh batch instantly, built in your browser with cryptographically secure randomness, and nothing you make ever leaves your device.

That covers what you open a generator to make: API keys, tokens, reset codes, unique IDs, salts, PINs, and piles of throwaway test data.

1. Pick a preset (or skip it). Hit Hex, Base62, URL-safe token, API key, and the rest. Each button loads a sensible length and the right character set for that format, so you are not guessing which boxes to tick.
2. Set the length and count. Length is characters per string, up to 256. Count is how many show on screen at once, up to 100. Short human codes might be 6 to 10, tokens and keys usually want 24 or more.
3. Tune the character types. Toggle lowercase, uppercase, digits, and symbols in any mix. A preset just sets these for you, and you can move from there.
4. Drop confusing characters if a person will read the string. Tick Exclude look-alikes to strip the ones that get misread by eye, like the digit 0 and the letter O.
5. Copy or download. Copy all grabs everything on screen, one per line. Need more than a screenful? Use Export a batch to download up to 100,000 strings as a plain text file.

If you untick every character type and leave the custom field empty, there is nothing to draw from, so generation pauses until you pick at least one set.

The character set is not a style choice. It decides whether your string actually works where you paste it, and getting it wrong is how a token breaks inside a URL or a key gets rejected by an API.

Hex gives you 0 through 9 and a through f, the natural format for raw bytes: encryption keys, salts, hashes, checksums. Every two hex characters are one byte, so a 32-character string is 128 bits and a 64-character one is 256 bits, no mental math. There is an uppercase version too, for systems that expect A through F.

Base62 is letters and digits, nothing else. It packs a lot of possibilities into a short string while staying safe to drop into a URL or a filename, which makes it a good pick for short unique ids.

URL-safe token is base62 plus the dash and the underscore, the alphabet used for tokens that ride along inside links and query strings. No characters that need escaping, so a password-reset link or a share URL survives being copied through email and chat without getting mangled.

API key is a 40-character alphanumeric string, the shape most services hand out. Long enough to be unguessable, plain enough that it never trips up a header or config file.

Alphanumeric is the general workhorse when you just want letters and digits, at whatever length you set. Numeric PIN is digits only. Letters only skips digits and symbols for the odd case that wants pure text. Whatever a preset sets, you can still nudge the length or flip a toggle afterward, so treat it as a starting point you are free to adjust.

Plenty of quick web tools get this wrong. A lot of them build "random" strings with JavaScript's Math.random(), which is fine for shuffling a playlist and unsafe for anything meant to be a secret. It is a formula seeded by something simple like the clock, so if someone works out the seed they can reproduce the whole sequence.

This tool uses crypto.getRandomValues instead, the browser's cryptographically secure generator, for every character, so there is no recoverable seed and no pattern for anyone to exploit. An attacker rarely needs to crack a token outright when simply predicting the next value would be enough, and secure randomness leaves no way to predict it. Simple rule: if the string protects something, identifies someone, or would matter when a stranger guesses it, it needs secure randomness. That means passwords, keys, tokens, salts, and reset codes.

The strength readout next to the buttons shows entropy in bits, a measure of how many strings an attacker would have to try. Two things push it up, more length and a bigger alphabet, and length is the cheaper of the two. That is why a long string drawn from a small alphabet usually comes out stronger than a shorter string from a fancier one.

Rough targets that hold up in real use:

• Human-typed codes like invites and coupons: 6 to 12 characters, where being easy to read counts for more than raw strength.
• API keys and session tokens: 32 characters of alphanumeric is a common standard, 48 to 64 for high-stakes keys.
• Encryption keys and salts: match the length to the bits you need, so 32 hex characters is 128 bits and 64 is 256.

The on-screen count tops out at 100, about all you can reasonably eyeball. When you need real volume, the Export a batch box generates up to 100,000 strings and downloads them as a text file, one per line, built in chunks so the tab stays responsive. Handy for seeding a test database, filling a fixtures file, or producing a stack of unique codes in one go.

The digit 0 next to the capital O and the lowercase o. The digit 1 next to the lowercase l and the capital I. On plenty of fonts they are nearly identical, and that turns into typos the moment a human reads a string off a screen or aloud down a phone line. Tick Exclude look-alikes and those six characters drop out of the pool, which is the exact set the checkbox prints beside it. You give up a sliver of entropy in exchange for a string nobody misreads, which is worth it for coupon codes, setup keys, and anything you read out to someone. For strings only a machine touches, leave it off and keep the extra strength.