Random Strings
Generate random strings from exactly the characters you choose, for coupon codes, test fixtures, invite tokens or filenames. You get one string per line, up to 10,000 at a time, drawn from the browser's cryptographic random generator.
Length: 12
Count: 3
Sets: A-Z, a-z, 0-9
Exclude: I l 1 | O 0 o
Unique: on
Entropy: ~69.7 bits per stringk7Rm2QxW9pLc
Bv4nT8zYh3Fs
Jd6wXq2Nr9KeThe ticked sets and anything typed into Custom merge into one alphabet with duplicates removed. Each character in that alphabet is equally likely at every position.
Drops I, l, 1, |, O, 0 and o. Use it for anything read aloud, printed on a card or typed from a screenshot. It costs a little entropy per character.
No string appears twice in the list, because the tool redraws duplicates. That makes the batch slightly less random than independent draws. If you ask for more unique strings than can exist, the tool says so instead of generating.
The tool does not force every set to appear. For example, a 6-character string from A-Z and 0-9 can come out all letters. If a system demands at least one digit, use the password generator or add length.
Randomness comes from crypto.getRandomValues(), and each
character is picked with rejection sampling: the tool discards a
32-bit value that falls in the uneven tail above the last full
multiple of the alphabet size. That removes the small bias a plain
% length introduces.
The header shows the entropy per string, length × log2(alphabet size). For a rate-limited one-time code, 30 to 40 bits is plenty. Give bearer secrets 128 bits. An API key or a password reset token works as a secret on its own, and 22 characters of A-Za-z0-9 reach 128 bits. Short strings from a small alphabet run out fast, so check the count against the space before you rely on Unique only.
function randomString(length, alphabet) {
const chars = Array.from(alphabet);
const n = chars.length;
// Largest multiple of n below 2^32: values above it would bias the result
const limit = Math.floor(0x100000000 / n) * n;
const buf = new Uint32Array(1);
let out = "";
while (out.length < length) {
crypto.getRandomValues(buf);
if (buf[0] < limit) out += chars[buf[0] % n];
}
return out;
}
const ALNUM = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
console.log(randomString(16, ALNUM));Never use Math.random() for anything that must be hard to guess. This snippet makes one getRandomValues() call per character for clarity; fill a larger array at once for speed. out.length counts UTF-16 units, so keep the alphabet in the BMP.
import secrets
import string
alphabet = string.ascii_letters + string.digits
print("".join(secrets.choice(alphabet) for _ in range(16)))
# Unique batch
batch = set()
while len(batch) < 100:
batch.add("".join(secrets.choice(alphabet) for _ in range(8)))
print(len(batch))
# URL-safe shortcut, length is about 1.3 x nbytes
print(secrets.token_urlsafe(16))Use secrets, not random. The random module is a Mersenne Twister and its output can be predicted after enough samples.
<?php
function randomString(int $length, string $alphabet): string
{
$chars = mb_str_split($alphabet);
$max = count($chars) - 1;
$out = '';
for ($i = 0; $i < $length; $i++) {
$out .= $chars[random_int(0, $max)];
}
return $out;
}
echo randomString(16, 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789'), PHP_EOL;
// PHP 8.3+: Random\Randomizer does the same in one call
// echo (new Random\Randomizer())->getBytesFromString('abcdef0123456789', 16);random_int() is unbiased and cryptographically secure. str_shuffle() and rand() are neither.
Compare strings by entropy, not length. Entropy is length x log2(alphabet size), so 16 characters from 0-9 is 53 bits while the same 16 from A-Za-z0-9 is 95 bits. For a bearer secret, aim for at least 128 bits.
This tool follows the specifications below. Read them when you need the exact normative wording, for example to settle an edge case between two implementations.
Set the length and count, tick the character sets you want, and the list appears one string per line. Copy or Download takes it from there; Generate makes a fresh batch.
They come from crypto.getRandomValues(), the browser's CSPRNG, with rejection sampling so every character is equally likely. Whether a string is strong enough depends on its entropy, which is shown in bits above the list.
It guarantees no string appears twice in the batch by redrawing duplicates. If you ask for more unique strings than the length and alphabet allow, the tool says so instead of looping forever.
I, l, 1, |, O, 0 and o, the characters people misread when copying from a screen or a printed card. Excluding them removes those from every set, including your custom characters.
No. Each position is drawn independently from the combined alphabet, so a short string can miss a set entirely. Use the password generator when a system enforces composition rules.
For IDs with a known collision budget, use the Nano ID generator or the UUID generator. For credentials, use the password generator or the API key generator.