Random String Generator

Random string generator for any alphabet

This random string generator produces strings where every character is chosen independently and uniformly from the alphabet you select. It uses the browser's cryptographically secure random generator, so the output is suitable for things that must be hard to guess, such as API keys, session tokens and invitation codes, not just for test data.

Character sets

In custom mode duplicate characters are ignored, so typing AAB gives a two-character alphabet in which A and B are equally likely.

How long should a random string be?

The unpredictability of a string is length × log2(alphabet size) bits. A few reference points:

• 32 hex characters = 128 bits, the size of a UUID or an AES-128 key.
• 22 URL-safe characters ≈ 132 bits, a compact yet strong token.
• 43 URL-safe characters ≈ 258 bits, similar to encoding 32 random bytes in Base64URL.
• 8 digits ≈ 27 bits: fine for a one-time code that expires quickly, far too weak for a permanent secret.

For API keys, aim for at least 128 bits. If you need the raw bytes instead of text (for example an HMAC key), the random byte generator outputs hex, Base64 or code arrays.

Example

Length 24, URL-safe alphabet, three strings:

q3ZfK_8vTn-L2wRbX0pYs7Hd
Mh4-cVu9Qe_Tz1kB6nGx0aJr
Y7wLs2P_d5Nf-tR8mCq3ZvKb

Common uses

• API keys and webhook secrets for your own services, where both sides only need to compare the value.
• Session IDs, CSRF tokens and password-reset links when prototyping authentication flows.
• Test fixtures that need unique values of an exact length, for example to test a VARCHAR(32) column or a field-length validator.
• Temporary file and folder names that must not collide in a shared directory or storage bucket.
• Stress-testing inputs with the "all printable" set, which quickly reveals escaping bugs in forms, CSV exports and SQL queries.

A random string is not automatically unique. Two strings from a large alphabet are extremely unlikely to match, but if uniqueness is a hard requirement, enforce it with a database constraint as well.

Tips

• For codes that humans read and type, such as voucher codes, remove confusing characters with a custom set like ABCDEFGHJKMNPQRSTUVWXYZ23456789.
• Prefer the URL-safe set for anything placed in a URL, cookie or file name; it avoids +, / and =, which need escaping.
• If you need a standard identifier format rather than a free-form string, use the UUID generator.
• To create strings that follow a specific pattern, such as ABC-1234, the regex-based data generator is a better fit.

Privacy

All strings are created locally in your browser. Nothing is sent to a server, which matters when the output is going to become a real secret.

Random string generator in Python

Build the string by picking characters from an alphabet: string.ascii_letters + string.digits is the same A–Z a–z 0–9 set this page uses by default. The common mistake is reaching for random.choice() or random.choices() when the string is an API key, a reset token or a password. The random module is reproducible from its seed and is not meant for security, so use secrets.choice() whenever the string protects something. For hex or URL-safe tokens, secrets.token_hex() and secrets.token_urlsafe() are shorter, but their argument counts bytes, not characters.

import secrets
import string

alphabet = string.ascii_letters + string.digits   # A-Z a-z 0-9
print("".join(secrets.choice(alphabet) for _ in range(16)))

# Ten strings from a custom character set
custom = "ABCDEF0123456789"
for _ in range(10):
    print("".join(secrets.choice(custom) for _ in range(8)))

# Shortcuts: the argument is a number of bytes, not characters
print(secrets.token_hex(8))        # 16 hex characters
print(secrets.token_urlsafe(12))   # 16 characters from A-Z a-z 0-9 - _

For a quick batch without a script, set the length and character set above and copy the result.