Random String Generator
Generate one string or ten thousand, of any length, from any combination of uppercase, lowercase, digits, symbols and your own extra characters. Every character is drawn from the browser cryptographic random number generator using rejection sampling rather than a modulo, so no character is more likely than another. The entropy figure shown is the genuine strength of the result, and an estimated time to guess it is shown alongside. Everything is generated in your browser; nothing is uploaded and no result is recorded anywhere.
How it works
Every character is drawn from the browser’s cryptographic random number generator using rejection sampling, not a modulo. Taking a remainder biases the result toward the start of the alphabet whenever the alphabet size does not divide the generator’s range evenly.
The entropy figure below is the real strength of the result: the length multiplied by the base-2 logarithm of the pool size. It only holds because the characters are drawn independently — a string you chose yourself has far less entropy than its length suggests.
Values are generated in your browser and never sent anywhere.
Pool of 62 characters — about 95.3 bits of entropy per string. An attacker guessing ten billion times a second would need on average 77.3 billion years to find one.
Adjust the settings above and values appear here.
Frequently asked questions
Are these strings safe to use as API keys or tokens?
The randomness comes from the browser cryptographic random number generator, which is the same source used for keys elsewhere, so the values themselves are sound. What matters more is length: aim for at least 128 bits of entropy, which the figure below the controls tells you directly.
What does the entropy figure actually mean?
It is the length multiplied by the base-2 logarithm of the pool size — the number of bits an attacker would have to search. It only holds because the characters are drawn independently at random; a string a person chose has far less entropy than its length suggests.
Why does the generator avoid taking a remainder?
Mapping a random number onto an alphabet with a modulo makes the first few characters of that alphabet slightly more likely, because the generator range rarely divides evenly by the alphabet size. Rejection sampling discards the uneven tail instead, which costs almost nothing and removes the skew.
What does "one of each set" do?
It guarantees every enabled character set appears at least once in each string, which is what most password policies require. The guaranteed characters are then shuffled through the string rather than being placed at the front, so their position is not predictable.
Why would I turn on "avoid look-alikes"?
It removes characters that are easy to confuse when read aloud or retyped — capital I, lowercase l, the digit 1, capital O and zero. Worth it for anything a person has to transcribe, at a small cost in entropy.
Related tools
Password Generator
This password generator creates strong, cryptographically random passwords with adjustable length and character sets, in your browser.
UUID Generator
This UUID generator creates RFC 4122-compliant v4 (random) and v7 (time-ordered) UUIDs, one at a time or in bulk, entirely in your browser.
Random Hex Generator
Generate random hexadecimal strings of any length, with presets for the common key and token sizes.