Random String Generator
Make secure random strings, tokens and codes in bulk. Runs in your browser.
About this random string generator
This random string generator makes strings of random characters for API keys, tokens, invite codes, coupon codes and test data. You choose the characters, the length and how many you need, up to 10,000 at a time, and it shows you exactly how many bits of entropy each string has.
It opens with ten 32-character alphanumeric strings already made. Pick a preset like Hex, Base58 or Base64URL, or build your own alphabet with the checkboxes, an extra-characters box and a leave-out box. Add a fixed prefix such as sk_live_, split the string into groups like ABCD-EFGH-JKLM, and export the batch as lines, a JSON array or a CSV column.
Every character is picked by your browser's cryptographic random generator, not Math.random, and nothing is sent to a server. Your settings go into the page address so you can bookmark them. The strings themselves never do.
Features
Presets for real formats
Alphanumeric, lowercase hex, Base64URL, Base58 (no 0, O, I or l), Crockford Base32, grouped coupon codes, digits only, and all printable characters. Each preset sets a sensible length you can change.
Entropy you can trust
The bits figure is log2 of the exact number of possible strings. If you turn on one character from each group, it counts only the strings that pass that rule, so the number isn't inflated.
Repeat chance for the batch
For bulk runs it shows the birthday-bound chance that any two strings match. That tells you at a glance whether 8 characters is enough for 10,000 codes. It usually isn't.
No duplicates, checked honestly
With No duplicate strings on, repeats are thrown out. If your settings can't produce as many unique strings as you asked for, you get a clear message instead of a page that hangs.
Prefixes, suffixes and groups
Add fixed text before or after, and a separator every N characters. These are kept out of the entropy count because an attacker already knows them.
Bulk output in useful shapes
Click any row to copy one string. Copy all or download as plain lines, a JSON array, a CSV column with a header, or a comma-separated list.
How to use the random string generator
- 1Pick a preset or choose the characters, length and how many you need.
- 2Read the entropy in bits and the chance of a repeat, then add a prefix or grouping if you want.
- 3Copy one string, copy all, or download them as text, JSON or CSV.
When to use it
API keys and webhook secrets
Use the Base64URL preset at 43 characters for 258 bits, or hex at 64 characters for 256 bits. Add a prefix like whsec_ so the key is easy to spot in logs and secret scanners.
Coupon and gift card codes
The coupon preset uses uppercase letters and digits without look-alikes, in groups of four. People read these off a screen or a receipt, so removing 0, O, 1 and I saves support tickets.
Test fixtures
Make 1,000 unique 12-character IDs as a JSON array for a seed file. For whole records with names and emails, the fake data generator is a better fit.
How long should a random string be?
Work from bits, not characters. Each character adds log2 of the alphabet size: 4 bits for hex, about 5.95 bits for the 62 alphanumeric characters, 6 bits for Base64URL. Multiply by the length and you have the entropy of the whole string.
For anything an attacker could test offline, such as an API key or a password reset token, aim for 128 bits. That's 32 hex characters, 22 alphanumeric characters or 22 Base64URL characters. For short codes that a server rate-limits, like a 6-digit login code, much less is fine because guesses are capped.
For uniqueness the rule is different. With n strings of b bits, the chance of any repeat is about n squared divided by 2 to the power of b+1. So 10,000 strings of 8 digits (26.6 bits) have roughly a 39% chance of a clash, while 10,000 strings of 32 alphanumeric characters have a chance near 1 in 10 to the 50.
Is a random string generator secure?
It depends on the random source. Many quick scripts use Math.random, which is fast but predictable: with enough output, its internal state can be recovered and future values guessed. This page uses crypto.getRandomValues, the browser's cryptographically secure generator, which is the same source Web Crypto uses for keys.
The other trap is modulo bias. Taking a random byte and doing value % 62 makes the first few characters slightly more likely, because 256 isn't a multiple of 62. Here every pick uses rejection sampling: values that would cause bias are thrown away and drawn again, so each character in your alphabet has exactly the same chance.
Hex, Base58, Base64URL or Crockford: which alphabet?
Choose the alphabet by where the string will live.
- Hex (0-9, a-f): safe everywhere, easy to compare, but long. A 256-bit secret is 64 characters.
- Base64URL (A-Z, a-z, 0-9, - and _): the shortest URL-safe option, defined in RFC 4648 section 5. Good for tokens in links and headers.
- Base58: drops 0, O, I and l so people don't misread it. Used by Bitcoin addresses and many short ID schemes.
- Crockford Base32: digits and uppercase letters without I, L, O and U. Case-insensitive, so it survives being read over the phone. ULIDs use it.
Why use Mavros
| Mavros | Typical upload sites | |
|---|---|---|
| Random source | crypto.getRandomValues with rejection sampling | Often Math.random or not stated |
| Entropy shown | Exact bits, plus repeat chance for the batch | Rarely shown |
| Bulk limit | 10,000 strings, up to 4,096 characters each | One string, or small batches |
| Custom alphabet | Sets, extra characters, leave-out list, presets | A few fixed checkboxes |
| Where it runs | In your browser, nothing uploaded | Some generate on a server |
Tips
- Leave the prefix out of your security maths. sk_live_ plus 24 random characters has the entropy of the 24 characters only.
- If the string goes into a URL, stick to Base64URL, hex or alphanumeric. Symbols like + / ? and & need escaping, which the URL encoder can do, but it's easier to avoid them.
- Store API keys hashed on the server, the same way you would store passwords. A fast hash like SHA-256 from the hash generator is fine for long random keys.
- Need sortable IDs rather than secrets? A UUID v7 or ULID keeps database indexes tidy and still has plenty of random bits.
Questions
What is a random string generator used for?
It makes unpredictable strings for API keys, session tokens, invite links, coupon codes, temporary passwords and test data. The important settings are the character set and the length, which together decide how hard the string is to guess.
How many characters make a secure token?
Aim for at least 128 bits of entropy. That is 22 alphanumeric or Base64URL characters, or 32 hex characters. The tool shows the bits for your exact settings, so you don't have to work it out.
Are the strings truly random?
They come from crypto.getRandomValues, the cryptographically secure generator built into every modern browser. Rejection sampling removes modulo bias, so each allowed character is equally likely in every position.
Can two generated strings be the same?
With No duplicate strings switched on, never within one batch. Across batches it is possible but unlikely if the entropy is high; the repeat chance stat shows the risk for the batch size you chose.
What does exclude look-alikes do?
It removes 0, O, 1, l, I and the pipe symbol, which are easy to confuse in many fonts. Use it for codes people read or type. It lowers the entropy slightly, and the bits figure updates to match.
What is the difference between this and a password generator?
A password generator is tuned for one password a person will use, with strength advice and passphrases. This tool is for machines and bulk work: custom alphabets, prefixes, grouping, thousands of strings and JSON or CSV export.
Is anything sent to a server?
No. The strings are made in your browser and are never uploaded or stored. Only your settings, such as length and character sets, are written into the page address so you can bookmark them.