🎲Random String Generator

About this tool

Choose a character set (or type your own), the length and how many strings you need (up to 1,000), add an optional prefix such as sk_live_, and group characters if you like. Copy them all at once. The entropy of each string is shown so you know how hard it is to guess.

Making random strings that are actually random

Many "random" generators use Math.random() and take value % alphabet-size, which is predictable and slightly biased. This tool draws every character from crypto.getRandomValues, the browser's cryptographically secure generator, with rejection sampling, so each character is exactly equally likely. A test of 60,000 draws from three letters came out at about 20,000 each. The entropy is length × log2(alphabet size). 32 hex characters or 22 base64url characters give 128 bits, the usual target for API keys, session IDs and password-reset tokens. Look-alike-free and Crockford Base32 sets suit codes people read and type, such as invites, vouchers and licence keys. Base64url is safe in URLs and file names. A recognisable prefix such as sk_live_ helps humans and secret-scanning tools spot leaked keys. Honest limits: generated strings exist only in your browser until you copy them, but treat real secrets carefully afterwards, and store hashes of tokens server-side, not the tokens themselves. The password generator, the UUID generator and the hash generator are related.

Frequently asked questions