About the Random String Generator
A random string is a sequence of characters picked by chance, used for test data, temporary codes, API tokens, coupon codes, unique file names, placeholders and passwords. This generator makes as many as you want, from 1 to 4,096 characters each, built from the character sets you tick: capital letters, small letters, digits and symbols, plus any extra characters of your own. You can leave out look-alike characters such as O and 0 or I and l to make codes easier to read. The strings come from your browser's cryptographically secure random generator, and nothing is sent to a server.
Updated October 2026
How to use the Random String Generator
- 1Choose the length of each string and how many you want.
- 2Tick the character sets to include, and add any extra characters.
- 3Optionally leave out look-alike characters.
- 4Press Generate for a new batch.
- 5Copy the strings or download them as a text file.
Examples of useful settings
- API key: 32 characters, letters and digits.
- Coupon code: 8 characters, capitals and digits, no look-alikes.
- Test data: 10 strings of 20 characters with symbols.
- Short ID: 6 characters, small letters and digits.
- PIN: 6 characters, digits only.
How much randomness do you get
Each character adds log2 of the number of possible characters in bits. With 62 characters, that is about 5.95 bits per character, so a 16-character string has about 95 bits. Adding symbols raises the count to around 90 characters and 6.5 bits each. More bits mean exponentially more guesses for an attacker, so length matters more than variety.
A few practical points are worth keeping in mind. Strings that include symbols may need escaping when you paste them into code, URLs or shell commands, so for tokens that travel through web addresses it is safer to stick to letters and digits. If you need case-insensitive codes, such as ones that will be read over the phone, use only capital letters and digits and leave out the look-alikes. The generator never repeats a check for duplicates, but with long strings the chance of two identical ones is effectively zero.
The same tool is useful when you need dummy content: placeholder names for files, filler text for forms, long inputs to test length limits and fuzzing input for software tests. Because you can add your own characters, you can also include accented letters, emoji or other Unicode characters to check that your software handles them. Download the batch as a text file, one string per line, to import it into a spreadsheet or a test script without any extra cleaning.
Finally, think about where the string will live. A token stored in a database should be hashed, not kept in plain text, in case the database leaks. A string embedded in a web address can end up in browser history and server logs. A string shown on screen can be seen over your shoulder. Treat generated secrets with the same care as the passwords they resemble, and rotate them if you suspect that anyone else has seen them.
Good practice
Do not reuse a random string across services, and never post secrets in public places. If you need to store secret tokens, use a proper secrets manager. For values that must be unique rather than secret, such as record IDs, the UUID Generator creates standard identifiers with a very low chance of repeats.
Related tools
The Password Generator makes memorable and strong passwords, the Random Hex Generator makes hexadecimal values, the UUID Generator creates unique IDs and the Hash Generator turns text into digests.
Features
- Length from 1 to 4,096 characters
- Up to 500 strings at a time
- Letters, digits, symbols and custom characters
- Option to avoid look-alike characters
- Cryptographically secure randomness
- Copy and download
Frequently asked questions
How random are the strings?
They come from crypto.getRandomValues, the same source of randomness that browsers use for security features. Each character is chosen without bias, so every combination is equally likely.
Can I use these as passwords?
For a throwaway account, yes. For important accounts, the Password Generator on this site rates strength and uses the same secure source. Use a password manager rather than trying to remember random strings.
How long should a token be?
For an unguessable token, aim for at least 128 bits of randomness. With 62 characters (letters and digits) each character gives almost 6 bits, so 22 characters are enough; 32 gives a comfortable margin.
Why leave out look-alike characters?
In codes that people read aloud or type by hand, O and 0, I, l and 1 are easy to mix up. Leaving them out reduces mistakes, at a small cost in the number of possible codes.
Are the strings stored anywhere?
No. They are made in your browser and disappear when you close or reload the page, unless you copy or download them.
Can I generate codes with only certain characters?
Yes. Untick the standard sets and type your own characters in the extra box. For example, 0123456789ABCDEF gives hexadecimal digits, and ACDEFGHJKLMNPQRSTUVWXYZ23456789 makes easy-to-read coupon codes.