Versatile WebWorks logo
Versatile Web Works
HomeUtilitiesBlogWrite For UsContact
Back to Utilities

Random String Generator

Generate random strings from a custom character set with full control.

Advertisement
Loading...

What this tool does

Random strings are useful for generating API keys, coupon codes, test data, temporary passwords, and unique identifiers when a full UUID is overkill. This tool generates random strings from a customizable character set with full control over length, character inclusion, and ambiguity exclusion.

The strings are generated using a cryptographically secure random number source, making them suitable for security-sensitive applications. You can exclude visually ambiguous characters (0 vs O, 1 vs l vs I) for human-readable codes, or include the full character set for maximum entropy per character.

Usage Example

// Generate a 32-character hex string (128 bits of entropy)
const apiKey = Array.from(crypto.getRandomValues(new Uint8Array(16)))
  .map(b => b.toString(16).padStart(2, "0")).join("");
// "a3f5b2c1e9d8f7a6b5c4d3e2f1a0b9c8"

// URL-safe base64 of 24 random bytes
const token = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(24))))
  .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
// "x8K3mN2pQ9rT4vW7yB5cE1fG6hJ8kL0n"

Common Edge Cases

  • Math.random() is not cryptographically secure and should not be used for tokens, passwords, or any security-sensitive identifier. Use crypto.getRandomValues() or crypto.randomBytes() instead.
  • The entropy per character depends on the character set size: 6 bits per char for 64-character set, 5.17 bits for 32-character, 4.7 bits for 26-letter.
  • Very short strings (under 16 characters) have insufficient entropy for any security use, even with a large character set.
  • Including all character classes (upper, lower, digits, symbols) maximizes entropy but reduces readability. Choose based on whether humans need to read the string.
  • Base64 encoding of N bytes produces roughly 1.33N characters, so 24 bytes gives a 32-character token with 192 bits of entropy.

FAQ

Is this random string generator cryptographically secure?
Yes. The randomness comes from the browser's crypto API, which is suitable for generating session tokens, API keys, and other security-sensitive identifiers.
How long should my random string be?
For non-security identifiers (coupon codes, test data), 8-12 characters is sufficient. For API keys and tokens, use at least 24 characters from a 64-character set (192 bits of entropy).
What does avoiding ambiguous characters do?
It removes characters that look similar (0/O, 1/l/I, etc.) so the string is easier to read and transcribe by hand. This reduces entropy by about 1-2 bits per character.
Advertisement