Generate random strings of any length from the character sets you choose, or from your own custom alphabet. Every character is an unbiased draw from your browser's cryptographic random source, and the tool reports how many bits of entropy each string carries.
Settings
Recent results
Generated locally in your browser β your settings and results never leave this page.
Choosing an alphabet
The alphabet decides two things at once: how many possibilities each character contributes, and how much trouble the value causes downstream. A string that will appear in a URL, a filename or a shell command is safer without symbols. A string that a person will read aloud is safer without look-alike characters. A string that only a database will ever see can use everything.
The custom field exists for the cases where a checkbox set is the wrong shape. Voucher codes often use uppercase letters and digits with the ambiguous characters removed. Hex identifiers use sixteen characters. Some systems reserve particular punctuation. Pasting the exact alphabet is clearer than trying to approximate it with toggles, and the tool removes duplicates so a careless paste does not skew the draw.
How long is long enough
Work backwards from how many values you will generate. The relevant question is not “how many possibilities are there” but “at what point do two of my values collide”. Because collisions can happen between any pair, the risk rises with the square of the number of values drawn β the same reasoning behind the observation that a small group of people is surprisingly likely to contain a shared birthday.
The practical consequence: if you expect to generate a million identifiers, an alphabet of 36 characters needs about 11 characters before collisions become genuinely unlikely, not the 4 characters that a naive “a million possibilities” calculation would suggest. When in doubt, add characters β they are cheap.
Uniform draws and why the method matters
The obvious way to pick a character is to take a random number and reduce it modulo the alphabet size. That works, and it is subtly wrong: unless the alphabet size divides evenly into the range of the random number, the first few characters come up slightly more often than the rest. For a 62-character alphabet drawn from 32-bit values the bias is tiny, but it is real, and it is entirely avoidable.
This tool discards the values that would cause the skew and draws again, which is why the character distribution stays flat no matter what alphabet you choose. For an identifier it rarely matters. For anything security-adjacent it matters a great deal, and it costs nothing to do correctly everywhere.
Seeded mode
Switching to seeded mode replaces the cryptographic source with a deterministic generator driven by whatever seed you type. The same seed and the same settings always produce the same strings. That is useful for test fixtures you want to reproduce exactly, for demonstrations, and for any case where a reviewer needs to confirm the values were not adjusted after the fact.
The trade-off is that a seeded value is predictable to anyone who knows the seed. Use the default cryptographic mode for anything that has to be unguessable, and seeded mode when reproducibility is the point.
Formats
Results are available as a plain list, as CSV for spreadsheets, and as a JSON array for scripts. Entries beginning with a character a spreadsheet would treat as a formula are prefixed with an apostrophe in the CSV so they are read as text rather than executed. All three are produced in the page; exporting involves no upload.
Privacy
Generated strings never leave your browser. They are not sent to a server, not stored, not logged, and not encoded into the page URL.
How to use the Random String Generator
- Set the length you need and how many strings to produce.
- Tick the character sets to draw from, or paste your own alphabet into the custom field to use only those characters.
- Turn on "exclude look-alike characters" if the strings will be read by a person.
- Generate, then copy the list or download it as text, CSV or JSON.
Frequently asked questions
What is this tool for?
Anything that needs an arbitrary identifier: test fixtures, cache keys, filenames, coupon codes, sample records, placeholder values in a database. It is deliberately general β you choose the alphabet and the length, and the tool draws characters uniformly from what you specified.
How random are the strings?
Characters come from crypto.getRandomValues, your browser's cryptographically strong generator, and are mapped onto your alphabet with rejection sampling so no character is favoured. A seeded mode is available when you need the same strings again from the same seed.
Can I use this to generate passwords?
You can, but the dedicated password generator is a better fit: it can guarantee at least one character from every set you select, which many sign-up forms require, and its presets are built around password lengths. This tool is aimed at identifiers rather than credentials.
What does the custom alphabet field do?
It replaces the character-set checkboxes entirely. Paste the exact characters you want and the tool draws only from those, removing duplicates first. It is the easiest way to produce values in a restricted alphabet β hex digits, uppercase-only voucher codes, or a set that excludes characters your system treats specially.
How many bits of entropy does each string carry?
The tool reports it under the result. The figure is the base-2 logarithm of the alphabet size, multiplied by the length. A 10-character string from a 36-character alphabet carries about 51.7 bits. If you are generating identifiers that must not collide, this is the number to reason about.
Will two generated strings ever be the same?
It is possible, and the chance grows faster than most people expect. As a rule of thumb, collisions become likely once you have generated roughly the square root of the number of possible values β so a 6-character alphanumeric string has about 2.2 billion possibilities but starts colliding after a few tens of thousands of draws. If uniqueness matters, use a longer string or a UUID.
Is anything I generate stored?
No. Strings are produced in your browser and stay there. Nothing is uploaded, logged or added to the page URL.
