DevKits

Random String Generator — Configurable Random ASCII / Alphanumeric

Generate one or many random strings of configurable length and character set. Toggle uppercase, lowercase, digits, symbols, or a custom alphabet. Optional exclude-ambiguous mode (0/O/1/l/I). Cryptographically strong by default. 100% local.

Last updated:

Character set:

Configure length, count, and character set (uppercase / lowercase / digits / symbols / custom). Optional exclude-ambiguous mode drops 0/O/1/l/I. Cryptographically strong by default — uses crypto.getRandomValues with rejection sampling.

What is Random String?

Random string generation covers a wide range of use cases: API keys, session tokens, test fixture IDs, invite codes, share links, coupon codes, sample seed data. This tool exposes every knob you're likely to need — length, count, per-category toggles, custom alphabet, ambiguous-character filter — while defaulting to cryptographically strong randomness (crypto.getRandomValues with rejection sampling) so tokens are safe to use in production out of the box. For non-security fixtures where speed matters more, flip off strong mode for a faster Math.random path.

How to generate a random string online

  1. 1Set the length (how many characters per string) and count (how many strings to generate).
  2. 2Choose your character set — uppercase / lowercase / digits / symbols — or add custom characters.
  3. 3Optionally exclude ambiguous characters (0, O, 1, l, I) for user-facing strings.
  4. 4Toggle 'cryptographically strong' if the strings need to be unpredictable (tokens, secrets); leave it on for safety.

Use Cases

Generate API keys or session tokens

32-char uppercase + digits gives ~192 bits of entropy — more than enough for session cookies or short-lived API keys.

Invite / referral codes

8-char alphanumeric with 'exclude ambiguous' — human-readable and hard to guess. Enable digits + uppercase, disable symbols.

Test fixture IDs

Batch-generate hundreds of unique-looking IDs for populating a test database — flip off crypto for speed.

One-off coupon codes

10-char uppercase for a promo campaign. Copy the batch straight into your marketing platform.

Tips & Best Practices

  • For security tokens, target at least 128 bits of entropy. 22 alphanumeric chars ≈ 128 bits.
  • 'Exclude ambiguous' is critical for anything a user might type or read aloud — support tickets drop noticeably.
  • Adding symbols raises entropy per character but reduces URL-safety. Skip symbols for URL / filename usage.
  • Custom characters get de-duplicated with the built-in set to avoid oversampling repeated characters.

Frequently Asked Questions

How is this different from the Password Generator?

The Password Generator is opinionated: strong-only, symbol-heavy, single-string output focused on human-memorable-yet-secure passwords. The Random String Generator is more general — batch mode, custom alphabets, longer strings — for API keys, seed values, test IDs, and fixture data.

Is the output cryptographically strong?

Yes by default — uses window.crypto.getRandomValues with rejection sampling to avoid modulo bias. Toggle off for a faster non-cryptographic Math.random source (fine for test fixtures where speed matters more than strength).

Can I define a custom alphabet?

Yes. The 'Custom characters' field adds any characters you type to the alphabet. Combine it with the built-in category toggles to define exactly the character set you want.

What does 'exclude ambiguous' do?

Removes visually confusable characters (0, O, 1, l, I) from the alphabet. Useful for user-facing strings that will be read aloud or manually typed — reduces support tickets from 'I can't tell if that's a zero or a letter O.'

Related Tools