What it does
A random string generator is easy to build badly. The usual mistakes are a weak source of randomness, a modulo operation that quietly favours the first characters of the alphabet, and a “secure” label that disappears when the browser lacks the API. This tool tries to avoid all three. It generates one or many strings, from the exact character sets you choose, and it stops rather than falling back when secure randomness is unavailable.
The output is plain text, one string per line. You can copy it, download it, or generate a new batch. Changing the length, count, alphabet, or ambiguous-character setting produces a fresh batch immediately. The “Generate again” button produces a new batch with the same settings.
Where the randomness comes from
The tool calls crypto.getRandomValues, the browser’s cryptographically strong random source. It does not use Math.random, which is designed for simulations and games rather than secrets. It also does not use modulo alone to map a random integer into the alphabet, because that introduces a small bias when the range does not divide evenly. The helper rejects values outside a safe bound before taking the remainder.
Secure randomness is only available in a secure context in most browsers — HTTPS or localhost. If the API is missing, the generator displays an error and refuses to produce output. A random string tool that silently downgrades is worse than one that stops, because the failure is invisible in the result.
Character sets
Lowercase, uppercase, digits, and symbols are independent. Select any combination, or supply your own characters. The combined alphabet is de-duplicated, so selecting a custom string that overlaps the lowercase set does not double the weight of those letters. The length you ask for is always the length you get, unless the alphabet is empty.
When the length is at least the number of selected classes, the generator guarantees one character from each class. This is useful for systems that require a digit and a symbol but do not care where they appear. The guaranteed characters are shuffled into the final string, so they do not sit in a predictable prefix. If the length is too short to hold every class, the guarantee is skipped rather than silently increasing the length.
“Exclude ambiguous” removes I, l, 1, O, 0, and o. That helps when a code will be read aloud, printed, or copied by hand. It does not make a string pronounceable, and it does not remove every glyph that can be confused in every font.
Length and entropy
Entropy is usually estimated as the length multiplied by the base-2 logarithm of the alphabet size. A 20-character string from a 62-character alphabet has a raw ceiling of about 119 bits. A 16-character string from the same alphabet has about 95 bits. Add symbols and the alphabet grows; shorten the string and the total falls. The guarantee of one character per class can reduce the true count slightly, which is why the display calls the figure a raw estimate.
For most API tokens, 128 bits is a reasonable minimum. For a short-lived one-time code, much less is acceptable because the code is rate-limited and expires. For an account password, the surrounding system matters more than the raw string: hashing, rate limiting, and a password manager do more for account safety than adding five characters to a token that will be reused.
Examples
Before
Length: 20 · Count: 4
Character sets: lowercase, uppercase, digits, symbolsAfter
q7#Kd2!vLm9@Xp4$Rt8B
N3%wYc6^Ha1&Js5*Ge0U
z8!Mf4@Qb7#Vn2$Kx9L
T5&Rj1*Wd8^Cp3!Hs6ZThese strings contain characters that some systems reject, such as # and@. That is not a flaw in the generator; it is a reason to check the destination’s rules before choosing a symbol-heavy alphabet. A token that cannot be submitted is not a secure token.
Before
Length: 12 · Count: 3
Character sets: uppercase + digits
Exclude ambiguous: onAfter
K7MQ4XP9RT2W
H3NC8YF5VB6L
P9WD2KX7GM4TThe alphabet is reduced by the exclusion, so the entropy per character is lower than the full uppercase-plus-digit set. The visible length is unchanged. That is the trade: fewer confusable glyphs in exchange for a slightly smaller alphabet.
Limits worth knowing
- The output is visible. A generated value lives in the textarea, may be kept by clipboard history, and can be captured by a screen recording. The page does not store it, but it cannot protect it from the rest of your device.
- This is not a password manager. Use a manager for credentials you need to keep. Use a generator like this for test fixtures, one-time codes, IDs, and tokens that will be stored by the system that consumes them.
- Entropy is not the whole story. A random string is only as useful as the system that accepts it. Server-side validation, expiry, rate limiting, and safe storage matter at least as much as the alphabet.
- There are caps. The page allows up to 100 strings of up to 256 characters each. The caps keep a mistake from freezing the tab; they are not a security boundary.
- No pronounceable output. Every string is sampled from the alphabet. If you need a passphrase, use a word-based generator instead; random letters are harder to read aloud and harder to remember.
Page updated