Tool
What the Random String Generator does
Random String Generator: generates String from Length and Characters. Example: length 24 and characters Letters + digits gives string inZb6unwe6T4f7r5gJXVe6hH.
This generator reads Length and Characters and produces String. Set your values, then run the tool to see the result.
A secret that travels to a third-party server is no longer entirely a secret. The Random String Generator exists to take that particular chore off your hands.
Nothing leaves the tab. You can watch your browser network panel while you use it and see for yourself.
Each field is explained further down, along with the method and a worked example that uses the default values.
What do the Random String Generator fields mean?
The Random String Generator uses 2 inputs. The fields arrive populated, which makes it easy to nudge a single figure and watch what moves.
| Field | What to enter | Default |
|---|---|---|
| Length | accepts 1 to 256 | 24 |
| Characters | choose from Letters + digits, Letters only, Hexadecimal, Digits only or Letters + digits + symbols | Letters + digits |
How does the Random String Generator work?
Each output is derived from the inputs above in a single pass; there is no hidden state carried between runs, so the same inputs always give the same generated output.
Validation runs before the calculation, which is why a mistyped value shows an error rather than a plausible-looking result.
Worked example
These are the values the Random String Generator loads by default, and the result it produces from them. The numbers below come straight from the default inputs, so you can verify them against the live tool.
| Length | 24 |
|---|---|
| Characters | Letters + digits |
| String | inZb6unwe6T4f7r5gJXVe6hH |
|---|
Choosing a character set for the job at hand
The right character set here depends entirely on where the string is going: a value that needs to survive being pasted into a URL, a filename, or a database column each has different safe characters.
| Letters + digits | Safest general default | Works unescaped almost everywhere: filenames, URLs, identifiers |
|---|---|---|
| Hexadecimal | Fixed 4 bits/character | The natural format for raw byte values: keys, IDs, colour codes |
| Digits only | Low entropy per character (3.32 bits) | Needs to be much longer for the same strength, mainly for numeric-only fields like OTP codes |
| Letters + digits + symbols | Highest entropy per character | Needs escaping in URLs and some databases. Avoid where the value must be pasted unescaped |
Worth knowing
- Every character set here is drawn from the CSPRNG via the same unbiased selection method the rest of this category uses, so entropy scales predictably with length regardless of which set is chosen.
- When in doubt for something machine-readable, alphanumeric is the safest default. It needs no escaping in almost any context a symbol-inclusive string would break.
How to use it
- Set Length (1 to 256).
- Pick a value for Characters: the options are Letters + digits, Letters only, Hexadecimal, Digits only or Letters + digits + symbols.
- Press Generate.
- Check String on the right.
- To keep the result, either copy the link or print the page. Both preserve what is on screen.
What this tool does not do
- Anything generated here is only as safe as wherever you store it afterwards.
- Randomness comes from your browser cryptographic source, which is suitable for real secrets.
- Where a standard has revisions, the version used is the one named in the method section.
- The result inherits any error in the inputs without flagging it.
Frequently asked questions
Length and Characters. That is the whole form. Defaults are loaded for all of them, so you can change one value at a time and watch how the result responds.
Length accepts 1 to 256. Go outside it and you get an error against that specific field instead of a misleading number.
With the values loaded when the page opens, string comes out as inZb6unwe6T4f7r5gJXVe6hH. Try changing one value. The answer refreshes without a page reload.
No. There is no upload step, no database, and nothing to delete afterwards.
It is free with no conditions: no sign-up, and no limit on how often you use it.
It follows the standard definition for this operation, so the result matches what a reference implementation would give.