Random string generator.

For an API key, a session id or a reset link: 128 bits is the usual floor, 256 for long-lived secrets. That is 32 hex characters or 22 Base64url characters for 128 bits, twice that for 256.

Characters picks each character from the sets you choose, for codes people read and type. Bytes draws raw random bytes and writes them as hex, Base64 or Base64url, the usual form of a machine secret.

Each character carries log2 of the alphabet size in bits (about 5.95 for 62 letters and digits), times the length. The figure assumes the uniform draw this tool makes; a string a person made up has far less.

crypto.getRandomValues, the browser's cryptographic generator, with rejection sampling so every allowed character is equally likely. Math.random is never used.

Choose characters or bytes, set the sets or the encoding, the length and how many; a new batch is drawn on every change and on Generate. Copy or download the list.

Turn on Leave out look-alikes to drop i, I, l, 1, L, o, 0 and O, for codes read aloud or typed from paper; add your own characters in the extra field.

No. The strings are drawn in your browser and the page makes no request.

No. The Random string generator is free and opens without a sign-in, an account or an install.

Nothing. The Random string generator holds your input in the page's memory, so closing or reloading the tab clears it, and it saves nothing in this browser.

Closest to the Random string generator: Password generator, Nano ID generator, UUID generator, Random number generator. Each opens on its own page, free and in the browser.

The Random string generator is one of 20 in its group. The group's page, /tools/security, lists them all.

The tool is free. Its interface is built from shadcn.io's own components (Button, Input, Slider and the rest of the registry under /ui), which come in React, Vue, Svelte and Solid. Pro adds the blocks and templates for the product around it.