Random strings show up everywhere in software: API tokens, session identifiers, temporary file names, database seed data, verification codes and one time secrets. What separates a safe one from an unsafe one is entirely the randomness source, since a string that looks random but was generated with a predictable algorithm can sometimes be guessed or reproduced by an attacker who understands how it was created.
Choosing a charset preset
Alphanumeric, using uppercase letters, lowercase letters and digits, is the most broadly compatible choice and the right default when a system's allowed character set is unknown or the string needs to be typed by a person occasionally. Hexadecimal, using only 0 through 9 and a through f, is the standard format for tokens, keys and identifiers in countless APIs and configuration files, and it maps naturally onto raw bytes since every two hex characters represent exactly one byte.
Base58 removes characters that are easy to confuse or that cause problems in certain contexts, dropping the digit zero, the uppercase letter O, the uppercase letter I and the lowercase letter l, along with the plus and slash characters that make standard Base64 unsafe inside a URL. It was popularised by Bitcoin addresses specifically because it avoids those lookalike characters, making it a strong choice whenever a random string might need to be read aloud, written down or typed by hand without visual ambiguity.
- Alphanumeric for general purpose tokens and identifiers with the widest compatibility.
- Hexadecimal for keys, API secrets and anywhere a byte for byte representation is expected.
- Base58 for short codes or identifiers a person might need to read or type manually.
- Custom charset when a specific system dictates an exact set of allowed characters.
Building a custom charset
Some systems restrict allowed characters more tightly than any standard preset, for example permitting only lowercase letters and digits, or excluding certain symbols that have special meaning in a shell script or a URL. Type any set of characters into the custom charset field and this random string generator draws uniformly from exactly those characters, with duplicates automatically ignored so the probability of each distinct character stays even.
Generating strings in bulk
Set a count above one and every string in the batch is generated independently, with no relationship between one string and the next beyond sharing the same charset and length. This is useful for seeding test data, producing a batch of one time invitation codes, or generating multiple API keys for different environments in a single pass.
Each string in a batch draws fresh random bytes, so requesting a hundred strings produces the same quality of randomness per string as requesting a single one. There is no shared internal state that would make strings in the same batch statistically related to each other.
How this random string generator avoids weak randomness
Every character is selected using crypto.getRandomValues, the Web Crypto API's cryptographically secure random source, which is backed by your operating system's own random number generator rather than a simple mathematical formula. This tool never uses Math.random anywhere in the generation path, because Math.random is explicitly documented as unsuitable for anything security related and its internal algorithm is not guaranteed to be unpredictable.
Selection also avoids modulo bias, a subtle flaw where naively mapping a random byte onto a charset using the remainder operator makes some characters slightly more likely to appear than others whenever the charset size does not evenly divide 256. This tool rejects and redraws any byte that would introduce that bias, so every character in the active charset has exactly equal probability at every position in the output.
| Preset | Character count | Common use |
|---|---|---|
| Alphanumeric | 62 | General purpose tokens and identifiers |
| Hexadecimal | 16 | Keys, API secrets, byte representations |
| Base58 | 58 | Short codes read or typed by a person |
| Custom | Variable | Systems with specific character restrictions |
How to generate a random string
- 1
Choose a charset
Pick alphanumeric, hex or Base58, or switch to a custom charset for specific requirements.
- 2
Set the length and quantity
Choose how many characters each string should have and how many strings to generate at once.
- 3
Generate the strings
Press generate. Every string draws fresh, unbiased random bytes from the Web Crypto API.
- 4
Copy the results
Copy a single string or the whole batch, one string per line, ready to paste elsewhere.
Related tools worth bookmarking
Sources and further reading
- MDN: Crypto.getRandomValuesThe browser API this tool uses for every character, instead of the insecure Math.random function.developer.mozilla.org
- OWASP Cheat Sheet SeriesGuidance on why security relevant tokens and identifiers require a cryptographic random source.owasp.org
- NIST SP 800-90A: Random Number GenerationFederal guidance on the properties a secure random bit generator must have.csrc.nist.gov
Frequently asked questions
Common questions about the random string generator.
Yes. Every character comes from crypto.getRandomValues rather than Math.random, and character selection is done without modulo bias, so every allowed character has an exactly equal chance of appearing at every position. This matches the same randomness quality used for session tokens and encryption keys.
Base58 is an alphabet that removes visually similar characters, specifically zero, uppercase O, uppercase I and lowercase l, along with plus and slash. It is the format Bitcoin addresses use, and it suits any random string that a person might need to read, write down or type manually without ambiguity.
A hex string uses only the sixteen characters 0 through 9 and a through f, which maps directly onto raw bytes, two hex characters per byte. This makes it the standard format for keys, tokens and identifiers in most APIs, while alphanumeric output packs more entropy per character since its charset is larger.
Yes, using the custom charset option. Type exactly the characters you want included, and the generator draws uniformly from that set instead of a preset. This is the right approach when a target system disallows specific characters that a standard preset would otherwise include.
There is no fixed limit built into the tool beyond what your browser tab can comfortably render and copy. Each string in a batch is generated independently with fresh random bytes, so a batch of a thousand strings has the same per string randomness quality as generating one string at a time.
No. Every string is generated locally in your browser using the Web Crypto API, with no network request involved. This matters since random strings from this tool are often used directly as API keys, tokens or other values that should never be transmitted or logged unnecessarily.