Skip to content
H HT99.
Read Articles
Everyday Utilities Free · No signup · Private · Instant results

Random String Generator

Generate random strings for tokens, IDs, and API keys using crypto.getRandomValues.

About the Random String Generator

This Random String Generator produces cryptographically secure random strings using crypto.getRandomValues. Unlike the Password Generator (which is tuned for human-readable passwords), this tool is optimized for machine tokens: API keys, session IDs, OAuth nonces, CSRF tokens, and pre-shared keys where length and charset are dictated by the consuming system rather than human usability.

Common presets cover the formats most libraries expect: 32-char hex (128 bits, the size of an MD5 or a UUID without hyphens), 16-char base64url (~96 bits, suitable for a short-lived session token), and full alphanumeric (62-char alphabet, used by Stripe and AWS for resource IDs). The custom preset lets you specify an arbitrary charset for legacy systems with restricted character sets.

The optional prefix is concatenated before the random portion — useful for environment-stamped tokens like sk_test_, pk_live_, or ghu_ (GitHub user-to-server tokens) that need to be visually identifiable in logs without exposing the random portion.

How It Works

For each character position, the code requests a 32-bit unsigned integer from crypto.getRandomValues(new Uint32Array(len)) and reduces it modulo the alphabet size. The modulo bias is negligible for all preset alphabets (62, 64, or 95 characters): the worst-case bias is alphabet_size / 232, which for a 95-character ASCII alphabet is roughly 1 in 45 million per draw — far below the bias introduced by users typing tokens.

Entropy per string is length × log2(charset_size). A 32-character hex string yields 32 × 4 = 128 bits — enough to make brute force infeasible even against a 1012 guesses-per-second attacker (crack time ≈ 1026 seconds, or roughly 3 × 1018 years). A 16-character base64url string yields 16 × 6 = 96 bits, sufficient for session tokens that expire within hours.

The base64url preset uses - and _ instead of + and / per RFC 4648 §5, making the output safe to embed in URLs, filenames, and JSON keys without escaping. For non-URL contexts (HTTP headers, cookies), standard base64 with +// is also acceptable.

The custom charset field accepts any Unicode characters but be aware that some characters may break when transmitted over protocols with restricted character sets (e.g. SMTP headers, basic-auth passwords). Stick to printable ASCII unless you know the consumer supports UTF-8.

Worked Examples

A 32-character hex string (preset = hex) gives 9f4c2a8e7b1d60f3c5e8a2190d4b6f7c. 128 bits of entropy — suitable for an MD5 replacement, a session ID, or a jti claim in a JWT.

A 22-character base64url string (preset = b64url) gives VfL3kQ2p9Hr8sN4YbJ1tXw — 132 bits of entropy. This is what crypto.randomBytes(16).toString('base64url') produces in Node.js, the standard format for OAuth state parameters.

A 40-character uppercase-hex string (preset = upper_hex) gives A4F8C2D9E1B7F3A6C5E8D2B9F4A7C1E3D6B9F2A7 — 160 bits, matching the output length of SHA-1. Useful for generating placeholder Git SHAs in test fixtures or HMAC-SHA1 verification codes.

When to Use This Tool

  • API keys and secret tokens prefixed with sk_live_, sk_test_, or your own convention.
  • OAuth 2.0 state parameters that prevent CSRF in authorization-code flow (RFC 6749 §10.12).
  • CSRF tokens embedded in hidden form fields (minimum 128 bits, 32 hex chars).
  • JWT jti claims to prevent replay attacks (RFC 7519 §4.1.7).
  • Pre-shared keys for WPA2/3 Enterprise or IPSec VPN tunnels.
  • Idempotency keys for HTTP POST requests to payment gateways (Stripe, Adyen).
  • Database column defaults for unique-but-not-secret identifiers in distributed systems.

Limitations & Disclaimer

This tool uses the Web Crypto API’s CSPRNG and reports entropy based on length and charset size. The modulo reduction introduces a negligible bias for typical alphabet sizes (under 1 in 4 million per draw). Generated tokens have no inherent signature — they are random identifiers, not cryptographic proofs. For authentication tokens, pair the random string with an HMAC or JWT signature so the server can verify integrity. Always transmit tokens over HTTPS. See our disclaimer for full terms.

Frequently Asked Questions

What length should I use for an API key?

For long-lived API keys (1+ year rotation), use at least 128 bits of entropy — 32 hex chars, 22 base64url chars, or 22 alphanumeric chars. For short-lived tokens (1-hour sessions), 96 bits (24 hex chars or 16 base64url) is sufficient. AWS access keys use 40 base32 chars (200 bits); Stripe secret keys use 24+ alphanumeric chars (~140 bits).

What is the difference between base64 and base64url?

Base64 uses <code>+</code> and <code>/</code> as characters 62 and 63, which break URLs and require escaping in JSON keys. Base64URL (RFC 4648 &sect;5) substitutes <code>-</code> and <code>_</code>, making the output safe for URLs, filenames, and JSON. Always prefer base64url for tokens transmitted over HTTP.

Is the modulo reduction safe for cryptographic use?

For alphabet sizes that evenly divide 2<sup>32</sup> (4, 16, 256, 65536), there is no bias. For other alphabet sizes (62, 64, 95), the bias is below 1 in 4 million per draw &mdash; negligible for any practical threat model. For audit-grade unbiased generation, use rejection sampling: redraw any value &gt; <code>2<sup>32</sup> - (2<sup>32</sup> mod alphabet_size)</code>.

Why does my hex string only contain 0-9 and a-f?

Hexadecimal uses 16 symbols (0-9 plus a-f). A 32-character hex string encodes 128 bits of randomness, with each character carrying 4 bits. Lowercase hex is the default for UUIDs (RFC 9562) and SHA-256 hashes; uppercase is used by Git SHAs (SHA-1) and Bitcoin addresses.

Can I use these strings as passwords?

You can, but they are not human-friendly. For human passwords, use the dedicated <a href='/tools/password-generator.php'>Password Generator</a> with length 16+ and full ASCII charset. For machine tokens (API keys, session IDs, nonces), use this tool &mdash; humans never type them.

Are these strings stored or logged?

No. Everything runs in JavaScript inside your browser. No network request is made, no cookie is set, and no analytics event fires for the generated value. Verify by opening DevTools &rarr; Network while generating.

Last updated: September 9, 2026  ·  Author: HT99 Tools Editorial Team