Random String Generator
Updated Free mock REST & WebSocket APIs
Generate random strings for test data, IDs, tokens, coupon codes or salts. Choose the length, the alphabet (or type your own) and how many you need — all made with a cryptographically secure generator.
🔒 Generated in your browser with crypto.getRandomValues — keys are never sent or stored.
How to generate random strings
- Set the length and choose a character set — or Custom to type your own alphabet.
- Add an optional prefix and set how many strings you need (up to 1,000).
- Copy them all or download a .txt file. The bits of randomness are shown for the settings you chose.
Which alphabet should I use?
| Alphabet | Bits per char | Good for |
|---|---|---|
| Hex (16) | 4 | Tokens, salts, anything stored as bytes |
| Crockford Base32 (32) | 5 | Codes people read aloud or type — no I, L, O or U |
| Lowercase + digits (36) | 5.17 | Case-insensitive IDs, subdomains |
| Alphanumeric (62) | 5.95 | Short IDs, API keys, URLs |
| Base64URL (64) | 6 | Compact URL-safe tokens |
How long should a random ID be?
For uniqueness, use the birthday bound: with b bits of randomness you can create about 2b/2 IDs before there's a 50% chance of a single collision. 64 bits (11 alphanumeric characters) gets you ~4 billion IDs; 128 bits (22 alphanumeric characters) is safe for practically anything. For secrets, aim for at least 128 bits.
Related tools
Embed this tool on your site
Browse all embeddable tools →Free for blogs, HR, payroll and contractor sites: copy one snippet — the widget sizes itself and matches your colors.
Get the embed code
Frequently asked questions
How random is it?
It uses crypto.getRandomValues, the browser's cryptographically secure random number generator (seeded by the operating system), plus rejection sampling so every outcome is exactly equally likely. That's stronger than the Math.random() most sites use.
Does a prefix add security?
No — a fixed prefix is public. It's useful for readability and for secret scanners, but only the random part counts toward the bits shown.
Can I generate strings without look-alike characters?
Yes. Choose Crockford Base32, or pick Custom and leave out characters such as 0/O and 1/l/I.
Is anything sent to a server?
No. Everything is generated by JavaScript in your browser, so nothing you type or generate is uploaded, logged or stored. It keeps working offline once the page has loaded.
Your business here? Sponsor this tool from $16/week. See placements