Random String Generator
Cryptographically secure random strings for API keys, tokens, passwords and test data, with the entropy shown in bits.
Open source on GitHubSettings
Presets
Random strings
Runs entirely in your browser. Nothing you paste here is uploaded or stored.
Entropy by character set. Bits per character, and the length you need for about 128 bits.
| Character set | Bits per char | Length for ~128 bits | Typical use |
|---|---|---|---|
| Digits only (10) | 3.32 | 20 chars → 66 bits | 6-digit PINs (19.9 bits) only work with rate limiting. |
| Hex (16) | 4.00 | 32 chars → 128 bits | Session IDs, secrets stored as hex. |
| Lowercase + digits (36) | 5.17 | 25 chars → 129 bits | Case-insensitive identifiers and URLs. |
| Alphanumeric (62) | 5.95 | 22 chars → 131 bits | API keys and tokens. |
| Alphanumeric + symbols (89) | 6.48 | 20 chars → 130 bits | Passwords stored in a password manager. |
How many bits is enough? How the strength label maps to entropy.
| Entropy | Label | What it means |
|---|---|---|
| Under 40 bits | Weak | Guessable offline in seconds to hours. Fine only for short-lived codes behind rate limits. |
| 40–63 bits | Fair | Resists online guessing, not a determined offline attack. |
| 64–99 bits | Strong | Good for most passwords and invite codes. |
| 100+ bits | Very strong | Recommended for API keys, tokens and secrets (128 bits is a common target). |
More free tools. Free, open source, no sign-up. See all tools · Source on GitHub
Frequently asked questions
Are these random strings secure?
Yes. Characters are chosen with crypto.getRandomValues, the browser’s cryptographically secure random number generator, not Math.random. Strings are generated on your device and never sent anywhere.
What is modulo bias and how is it avoided?
Mapping a random 32-bit number onto, say, 62 characters with the remainder operator makes the first few characters slightly more likely, because 2^32 does not divide evenly by 62. This generator uses rejection sampling: it discards random values from the uneven top of the range and draws again, so every character is exactly equally likely.
How is entropy calculated?
Entropy in bits is length × log2(character set size). A 16-character alphanumeric string has 16 × log2(62) ≈ 95 bits. Each extra bit doubles the number of guesses an attacker needs. Duplicate custom characters are removed first, so they don’t inflate the number.
Which characters count as ambiguous?
Characters that are easy to misread or mistype: I, l, 1, O, 0, o, the pipe and backtick, quotes, and look-alike pairs such as 5/S, 2/Z and 8/B. Excluding them is useful for codes people read from a screen or type by hand. It slightly lowers entropy per character, which the strength meter shows.
How many strings can I generate at once?
Up to 1,000 strings of up to 1,024 characters each. Turn on No duplicate strings to guarantee every string in the batch is unique.