Skip to content
H HT99.
Read Articles
Everyday Utilities Free • No signup • Instant results

Random String Generator

Generate random strings for tokens, IDs and keys.

About the Random String Generator

The Random String Generator produces cryptographically secure random strings from the character set of your choice. Pick a length, pick a count, pick a charset (alphanumeric, letters only, digits only, hexadecimal, or fully custom), and the tool returns one or more strings drawn from your browser’s CSPRNG via crypto.getRandomValues.

Random strings power a surprising range of backend plumbing: API keys, coupon codes, invite tokens, session IDs, test data, CAPTCHA challenges, and one-time passwords. Each use case has different requirements — API keys need high entropy (32+ characters), coupon codes must avoid ambiguous characters like O vs 0 or l vs 1, and TOTP secrets need Base32 encoding. The custom charset option lets you exclude ambiguous characters or restrict to URL-safe symbols.

For applications requiring a specific encoding (Base64, Base32, Base58, URL-safe Base64), generate a long alphanumeric string here and re-encode it. For cryptographic keys, prefer a dedicated key generator that uses rejection sampling to eliminate modulo bias — but for the vast majority of practical use cases, this tool’s output is more than sufficient.

How It Works

The generator requests len 32-bit unsigned integers per string from crypto.getRandomValues(). Each integer is reduced into the character set using modulo: chars[random_uint % chars.length]. This is the same algorithm used by the password generator, just generalized to arbitrary character sets.

The five built-in character sets cover the most common needs:

  • Alphanumeric (62 chars) — A-Z a-z 0-9. Default for tokens, API keys, and short URLs. 5.95 bits of entropy per character.
  • Letters only (52 chars) — A-Z a-z. Useful when digits would be misread (typed from print, read over phone). 5.70 bits per character.
  • Digits only (10 chars) — 0-9. Used for OTP codes, PINs, verification codes. 3.32 bits per character.
  • Hexadecimal (16 chars) — 0-9 a-f. Default for UUIDs, file hashes, MAC addresses. 4.00 bits per character.
  • Custom — any string you enter. Use to exclude ambiguous characters (e.g., ABCDEFGHJKLMNPQRSTUVWXYZ23456789 for Crockford Base32) or restrict to URL-safe symbols.

Entropy per string equals length × log2(charset_size). A 32-character alphanumeric string has 32 × log2(62) ≈ 190 bits of entropy — more than enough for an API key. A 6-digit OTP has only 6 × log2(10) ≈ 19.9 bits, which is why OTPs expire quickly and rate-limit failed attempts.

The custom charset is intentionally unrestricted — you can include any printable character. For URL-safe tokens, restrict to A-Z a-z 0-9 - _. For SQL-safe identifiers, avoid quote characters. For LDAP-safe values, avoid * ( ) \ NUL.

Worked Examples

Generating one 16-character alphanumeric string typically produces something like jX9kP3mN7vR2qL8b. With 62 possible characters per position, that is 16 × 5.95 ≈ 95 bits of entropy — sufficient for a public-facing API key but paired with a separate secret for authentication.

Generating 5 hexadecimal strings of length 32 each produces 5 SHA-256-like hex strings such as a3f7c1b2e9d4f8a6.... Each has 128 bits of entropy and is suitable as a session ID, file integrity token, or test fixture standing in for a real hash.

Using a custom charset ABCDEFGHJKLMNPQRSTUVWXYZ23456789 (Crockford Base32, which excludes I, L, O, U, 0, 1 for ambiguity) and length 8, the generator produces human-friendly coupon codes like K7P2RMWX. These are easy to read aloud, type from print, and distinguish over the phone — the design goals of Crockford’s Base32 spec.

For an 8-digit OTP code, use the num charset with length 8. The output has only ~26.6 bits of entropy, which is why SMS OTPs typically expire after 60 seconds and rate-limit to 3 attempts.

When to Use This Tool

  • Generating API keys and access tokens for OAuth clients and service accounts.
  • Producing coupon codes, gift card codes, and promotional voucher strings.
  • Creating test fixtures for unit tests and integration tests where deterministic identifiers would create false negatives.
  • Generating one-time passwords (OTPs) for SMS, email, or TOTP-based two-factor authentication.
  • Building invite-only signup codes that grant early access to a beta product.
  • Producing random short-URL slugs when an auto-increment integer would be too short or guessable.
  • Creating random passwords for accounts where a full password manager is unavailable.

Limitations & Disclaimer

This generator uses crypto.getRandomValues with simple modulo reduction, which introduces a tiny bias (~charset_size / 2^32) that is negligible for non-cryptographic use but should be eliminated via rejection sampling for cryptographic key material. The maximum length per string is 1024 characters and the maximum count is 100, sufficient for nearly all practical use cases but not for bulk test-data generation. The custom charset is unrestricted — you are responsible for ensuring the characters you choose are valid in your target context (URL-safe, SQL-safe, LDAP-safe, etc.). For Base64, Base32, or Base58 encoded output, use a dedicated encoding library after generating raw bytes. See our disclaimer for full terms.

Frequently Asked Questions

Are these strings cryptographically secure?

Yes. The generator uses <code>crypto.getRandomValues</code>, which draws from your OS&rsquo;s CSPRNG. For typical API-key and session-token use cases, the entropy is more than sufficient. For cryptographic key material (AES keys, RSA seeds), prefer a dedicated key generator that uses rejection sampling to eliminate the tiny modulo bias present in the simple modulo reduction.

How long should an API key be?

For a public-facing API key, 32 alphanumeric characters (~190 bits) is more than enough. For the secret half of an API key pair, 40 characters (~238 bits) is the modern recommendation. For short-URL slugs and coupon codes, 8 characters (~47 bits) is typical, but you should add a checksum or hash-prefix check to detect typos.

What is the most readable charset for human use?

Crockford Base32 (<code>ABCDEFGHJKLMNPQRSTUVWXYZ23456789</code>) is the gold standard. It excludes <code>I, L, O, U</code> and the digits <code>0, 1</code> to eliminate confusion with <code>1, l, I</code> and <code>0, O, Q</code>. The result is easy to read from print, type, and recite over the phone &mdash; ideal for coupon codes, gift card codes, and license keys.

Why use hexadecimal instead of alphanumeric?

Hexadecimal is the convention for hashes (SHA-256, MD5), UUIDs, MAC addresses, and file integrity tokens. Many systems expect hex output and will reject alphanumerics. Hex also has the property that each character encodes exactly 4 bits, making the math simple: 32 hex chars = 128 bits, 64 hex chars = 256 bits.

Can I generate Base64 or Base32 strings?

Not directly. This tool generates from a custom charset of your choice. For Base64, generate 16 bytes of binary and Base64-encode it. For Base32, use the Crockford charset (above) and length 8 / 16 / 26 for 40-bit / 80-bit / 128-bit values respectively. For URL-safe Base64, replace <code>+</code> and <code>/</code> with <code>-</code> and <code>_</code>.

How many strings can I generate at once?

Up to 100. The limit exists to prevent abuse and to keep the rendering fast in the browser. Each string consumes <code>4 &times; length</code> bytes of CSPRNG output (one 32-bit integer per character), so 100 strings of length 1024 each is 410 KB of entropy &mdash; well within the CSPRNG&rsquo;s capacity, but rendering becomes slow.

Last updated: July 21, 2026  ·  Author: HT99 Tools Editorial Team  ·  Reviewed by: HT99 Tools Editorial Team