A random string generator for tokens, keys and test data
The Random String Generator creates cryptographically random strings in bulk — from a single API key to 10,000 unique test values at once. Choose a ready-made alphabet (alphanumeric, hex, Base64url, Base58, Crockford Base32 or digits) or build your own from lowercase, uppercase, digits, symbols and any extra characters, then set the length, add a prefix such as sk_test_, and copy or download the batch as TXT, CSV or JSON.
Every character comes from crypto.getRandomValues, the browser’s cryptographically secure generator, with rejection sampling so each character in the alphabet is exactly equally likely. The page shows the entropy of each string in bits and the chance that a batch of this size contains a repeat, so you can pick a length with confidence rather than guessing.
Nothing is uploaded or stored: the strings exist only in this tab until you copy them.
How to use the Random String Generator
- Pick the Characters. Use hex or Base64url for tokens, Base58 or Crockford Base32 for codes people read or type, or “Custom character sets” to choose your own.
- Set the Length and How many you need. The entropy figure updates as you type — aim for 128 bits or more for secrets.
- Optionally exclude look-alike characters, require every chosen set, keep the batch free of duplicates, and add a Prefix or Suffix.
- Choose Lines, CSV or JSON for the output, then press Copy all or Download. Press Generate new for a fresh batch.
Random String Generator features
Unbiased by design
A naive byte % 62 makes the first eight characters of an alphanumeric alphabet 25% more likely. Rejection sampling discards the uneven tail, so every character has exactly the same chance.
Developer alphabets
Hex (either case), RFC 4648 Base64url, the Bitcoin Base58 alphabet without 0, O, I and l, and Crockford Base32 without I, L, O and U.
Honest entropy
Bits per string are exact — including the small reduction when every set must appear, counted with the inclusion–exclusion principle — along with the birthday-bound chance of a repeat in your batch.
Bulk and unique
Up to 10,000 strings per batch (2 million characters), with duplicates removed on request and a clear message when the settings allow too few distinct values.
Ready to use
Prefixes and suffixes, CSV quoted to RFC 4180 and JSON arrays, downloadable as files.
How long should a random token be?
Entropy is length × log₂(alphabet size). Each hex character carries 4 bits, Crockford Base32 5, Base58 about 5.86, alphanumeric about 5.95 and Base64url 6. For anything an attacker could try to guess offline — API keys, session IDs, password-reset links — use at least 128 bits; 256 bits leaves a wide margin.
Worked example: a 32-character hex string has 32 × 4 = 128 bits. The same strength needs 22 Base64url characters (132 bits), 22 Base58 characters (128.9 bits) or 26 Crockford characters (130 bits). A 6-digit numeric code has only 19.9 bits — fine for a one-time code that expires in minutes and allows a few attempts, never for a stored secret.
| Alphabet | Bits per character | Length for 128 bits | Good for |
|---|---|---|---|
| Hex (16) | 4 | 32 | Keys and IDs in logs, URLs, databases |
| Crockford Base32 (32) | 5 | 26 | Codes read aloud or typed; case-insensitive |
| Base58 (58) | 5.86 | 22 | Codes copied by hand; no 0/O or I/l confusion |
| Alphanumeric (62) | 5.95 | 22 | General tokens that must avoid symbols |
| Base64url (64) | 6 | 22 | Compact URL-safe tokens |
| Numeric (10) | 3.32 | 39 | OTPs and PINs (short-lived only) |
Duplicates and the birthday bound
Random values collide sooner than intuition suggests: with b bits of entropy, a repeat becomes likely after roughly 2b/2 values. The tool estimates the chance for your batch as 1 − e−n(n−1)/2b+1. A batch of 1,000 six-digit codes (19.9 bits) has a 39% chance of a repeat, and a million 8-character alphanumeric strings (47.6 bits) about 0.23%; at 32 characters the chance is effectively zero. With “No duplicates” ticked, any repeat is simply drawn again.
If you need IDs that sort by creation time instead, use the UUID Generator (v7). For human passwords with strength ratings, use the Password Generator; for memorable ones, the Passphrase Generator.
Tips for keys and tokens
- Store only a hash of an API key on the server (SHA-256 is fine for high-entropy keys) and show the full key to its owner once. The Hash Generator shows what that looks like.
- A recognisable prefix such as
sk_test_makes leaked keys easy to find with secret scanners and tells people what the string is. - Spreadsheet apps may treat a CSV value that starts with
=,+,-or@as a formula; untick Symbols if the file will be opened in Excel or Sheets. - These strings are random characters, not encodings of bytes: a 22-character Base64url string is not 16 bytes of binary data, although it has slightly more entropy.
Random String Generator FAQ
Is this random string generator secure enough for API keys?
Yes. It uses crypto.getRandomValues, the same cryptographically secure source browsers use for encryption, never Math.random(), with rejection sampling to avoid bias. Choose a length that gives at least 128 bits of entropy.
Are the strings sent to a server?
No. They are generated in your browser and exist only on this page until you copy or download them.
What is the difference between Base58 and Base32 Crockford?
Base58 uses digits and both letter cases minus 0, O, I and l, so it packs more bits per character but is case-sensitive. Crockford Base32 uses digits and upper-case letters minus I, L, O and U, so it is case-insensitive and easy to read aloud — a decoder treats lowercase and the look-alikes I/L as 1 and O as 0.
Why does requiring every character set lower the entropy?
It rules out strings that happen to skip a set, such as one with no digit. The effect is small — 12 characters from all four standard sets lose about half a bit (77.9 → 77.4) — and the figure shown is exact.
How many random strings can I make at once?
Up to 10,000 per batch, as long as length × count stays under 2 million characters. Generate again for more.
Can I use these as passwords?
Yes, they are random enough. For passwords people type, the Password Generator adds strength ratings and pronounceable options.