Random string · characters · letters
Random String Generator
Generate random strings, random characters or random letters - any length, from letters, digits, symbols or your own character set, for tokens, test data and identifiers.
••••••••••••••••••••••••••••••••
Entropy = length × log2(alphabet size). Exact here because every character is chosen independently and uniformly from the CSPRNG.
Generated in your browser with crypto.getRandomValues(). Nothing is sent or stored. Verify it
How the Characters Are Chosen
The tool builds an alphabet from the sets you switch on plus any custom characters, with duplicates removed. It then picks each character independently from that alphabet using crypto.getRandomValues(), the browser's cryptographically secure random number generator.
A random number is not automatically a fair choice. Reducing a random value with % alphabetSize makes some characters slightly more likely whenever the alphabet size does not divide the range evenly - this is modulo bias. The tool avoids it with rejection sampling: draws that would cause the bias are thrown away and drawn again, so every character in the alphabet is exactly equally likely. The CSPRNG guide shows the code and the arithmetic.
Reading the entropy
The readout shows length × log2(alphabet size) bits per string. With 62 letters and digits, 20 characters give about 119 bits and 32 give about 190. The figure is exact here only because the selection is independent and uniform; it says nothing about a string a person chose.
Random Characters and Random Letters
The quick sets cover the common jobs. Letters gives random letters A-Z and a-z only - for codes people read aloud, or to pick a random letter for a game. One character sets the length to 1, so each result is a single random character; ask for 10 or 100 of them in one go. Hex draws from 0-9 and a-f, and All characters adds punctuation.
Every character is equally likely within the chosen set, so a random letter from the letters set has a 1 in 52 chance of being any particular letter. Duplicates in a custom set are removed so they cannot tilt the odds.
When a Random String Is Secure
A random string is as strong as the generator behind it. Strings from a secure source with enough entropy are fine for tokens, invitation codes and similar values. If the string is a credential, treat it like one: the copy button clears your clipboard after 30 seconds, and nothing you generate is stored on this site.
For a value that a person must type, a passphrase is easier. For a key that an application uses, the API key generator works in random bytes and standard encodings, which is what most systems expect.
Random String Generator FAQs
How long should a random string be?
It depends on what it protects. Read the entropy line in the tool: 32 characters of letters and digits give about 190 bits, and 32 hexadecimal characters give 128 bits. For a secret key, the API key generator lets you choose the length in random bytes directly.
What does the entropy number assume?
That every character is chosen independently and uniformly at random from the alphabet - which is exactly how this tool works. The formula does not describe strings a person makes up; see password entropy explained.
Can I use only certain characters, such as hexadecimal?
Yes. Switch off the sets you do not want and turn on custom characters, for example 0123456789abcdef with only the custom set enabled. Duplicate characters are removed, so they cannot make some characters more likely than others.
Are emoji and accented letters allowed in the custom set?
Yes. Custom characters are taken as Unicode code points. An emoji built from several code points (some flags, skin tones, family emoji) is split into those parts, so prefer single characters.
Why not just use Math.random()?
Math.random() is not designed for security and MDN says not to use it for anything related to security. This tool uses crypto.getRandomValues(); the CSPRNG vs Math.random() guide explains the difference.
Related guides
CSPRNG vs Math.random(): Why Secure Password Generators Use Web Crypto
Password Entropy Explained
