Mapping a random byte (0–255) to an alphabet with the % operator favors the first characters whenever 256 is not a multiple of the alphabet size. The fix is to discard bytes above the largest multiple and draw again, which this tool does.

How many random strings can I generate at once?

Up to 1,000 strings of up to 1,024 characters each. Use Download .txt to save them one per line.

Can two generated strings be the same?

It is possible but extremely unlikely once each string has more than about 64 bits of entropy. For database IDs, add a unique constraint anyway so a collision fails loudly.

Why not use a UUID instead?

A version 4 UUID has 122 random bits in 36 characters. A 22-character base64url string carries about 132 bits, so it is shorter for the same strength. Use UUIDs when a system expects that format; there is a separate UUID generator on this site.

Random String Generator

Generate cryptographically secure random strings in bulk with your choice of characters, length and count, and see the entropy in bits for each string.

Show this tool on your website

Last updatedSeptember 17, 2026How we build & check our tools

Results will appear here once you enter your values.

This calculator requires JavaScript to function. Please enable JavaScript in your browser to use all features.

How the strings are generated

Every character comes from crypto.getRandomValues(), the browser's cryptographically secure random number generator, which is seeded by the operating system. It is not Math.random(): that function is fast but predictable, and its output can be reconstructed from a few samples, so it must never be used for tokens, passwords or invite codes.

Turning random bytes into characters has a classic trap. With a 62-character alphabet, byte % 62 makes the first 8 characters slightly more likely, because 256 is not a multiple of 62. This generator uses rejection sampling: any byte at or above 248 (the largest multiple of 62 below 256) is thrown away and a new one is drawn, so every character has exactly the same probability. Alphabets larger than 256 characters draw two bytes at a time.

Nothing is sent to a server. The strings exist only in your browser tab until you copy or download them.

How long should a random string be?

Strength is measured in bits of entropy: length × log2(alphabet size). Each extra bit doubles the number of guesses an attacker needs.

Use	Target	Example
Session IDs, API keys, reset tokens	128 bits or more	22 base64url characters, 32 hex characters
User passwords you store in a manager	80–128 bits	16–20 characters from letters, digits and symbols
One-time codes with rate limiting	20–40 bits	6–8 digits
Non-secret IDs, coupon codes	Enough to avoid collisions	See the birthday bound below

OWASP recommends at least 64 bits of entropy for session identifiers, and 128 bits leaves a comfortable margin. For uniqueness rather than secrecy, the birthday bound applies: with n bits you can create about 2^n/2 strings before a collision becomes likely, so 1 million IDs need at least 40 bits and 64 bits is safer.

Choosing a character set

Exclude look-alikes (I, l, 1, O, 0, o) when people will read or type the string, such as license keys or Wi-Fi passwords. The alphabet shrinks from 62 to 56, costing about 0.15 bits per character, so add a character or two.
Requiring one character from each set satisfies password policies but slightly lowers entropy, because some combinations become impossible. The effect is tiny for long strings.
Symbols can break things. Characters like &, # and = need escaping in URLs, $ expands in shell scripts, and quotes break config files. Use the URL-safe preset (A–Z, a–z, 0–9, - and _) for anything that goes into a URL, filename or environment variable.
Hex is the easiest to handle in code and databases but carries only 4 bits per character.

Frequently Asked Questions

Common questions about the Random String Generator

Yes. It uses crypto.getRandomValues with rejection sampling, the same source browsers use for key generation. For an API key or token, choose at least 128 bits of entropy, for example 22 URL-safe or 32 hex characters.

From the same team

Turn your GPU into an OpenAI-compatible API endpoint

Wide Area AI routes your LLM API calls to your own hardware over a Cloudflare Tunnel — free local inference with edge caching and automatic cloud failover. Works with any OpenAI SDK.

Start routing — free

VRAM Calculator Can I Run This AI?AI API Cost Calculator GPU for Model