Random String Generator

Create random strings of any length from the character types you choose: uppercase, lowercase, digits and symbols. You can leave out look-alike characters such as 0 and O when people will read the string aloud, and the tool shows the entropy of each result.

How to use it

Set the length and how many strings you need.
Choose which character types to include.
Tick the look-alike option if people will type them.
Press Generate.

When it helps

Creating tokens and secrets for development.
Making temporary passwords.
Generating identifiers for test data.
Building random file names.

Good to know

Longer is stronger; aim for 20 characters or more for secrets.
Leaving out look-alikes helps when strings are read aloud or typed from paper.
For real production secrets, generate them where they'll be used and never share them.

How strings are produced

The tool builds an alphabet from the character types you choose and then picks characters one at a time from it, using the browser's cryptographic generator. If you leave out look-alikes, the characters 0, O, o, 1, l and I are removed first.

Strength is measured in bits of entropy: length multiplied by the base-2 logarithm of the alphabet size. A 20-character string from 62 letters and digits has about 119 bits, which is far beyond brute-force reach.

Worked example: an API token

For a development token, choose 32 characters with letters and digits and press Generate. You'll get something like a 32-character string with about 190 bits of entropy. Store it in your secrets manager, and never paste it into chat or commit it to a repository.

For a password someone will type, choose fewer symbols and tick the look-alike option, so "O" and "0" can't be confused.

Choosing length and character types

Longer beats complex. Adding one character multiplies the possibilities by the alphabet size, while adding symbols to a short string helps only a little. For most secrets, 20 or more characters from letters and digits is more than enough.

Some systems limit which symbols they accept, so if a site rejects your string, turn off symbols and increase the length.

Where random strings are used

Developers use random strings for session tokens, API keys, password reset links, file names that must not clash, and test data. The important property is unpredictability, which is why secure random sources matter more than the character choice.

For database identifiers, consider UUIDs or longer random strings to prevent collisions. For anything humans must read, use shorter strings without look-alike characters.

Avoiding common mistakes

Don't use a random string you generated here as a password for several accounts, and don't truncate it to fit a form unless the remaining length is still long enough. If a site limits length, regenerate at that length.