Free Random String Generator
Choose a length and character set, and get unbiased random strings from your browser's cryptographic source. Nothing is sent to us.
What is a Random String Generator?
A random string generator produces text that cannot be predicted, for use as a token, an API key, a password or test data.
This one draws from the Web Crypto API and uses rejection sampling, so every allowed character is equally likely. It also shows the entropy of each string, which is the honest measure of how hard it is to guess.
- Set the length and how many strings you want.
- Pick the character sets, and exclude look-alike characters if people will read the result.
- Press Generate, then copy one string or the whole list.
Why Use This Generator?
- Cryptographic source: values come from the Web Crypto API rather than a predictable function.
- No modulo bias: rejection sampling keeps every character equally likely.
- Private: strings are created on your device and never reach our server.
How Long Should a Random String Be?
Entropy is length times the bits each character carries. These figures use letters and digits, 62 characters in all, except the PIN.
| Use | String | Entropy |
|---|---|---|
| One-time code | 6 digits | About 20 bits. Safe only with strict attempt limits and a short expiry. |
| Short reference | 8 characters | About 47 bits. Fine for a public reference, too weak for a secret. |
| Password | 16 characters | About 95 bits. A strong password when stored in a password manager. |
| Session or reset token | 24 characters | About 142 bits. Comfortably beyond the 128-bit level usually asked of tokens. |
| API key or secret | 32 characters | About 190 bits. A sensible default for long-lived secrets. |
How to Read the Result
What each setting does to the strings you get.
Length
StrengthEach extra character multiplies the number of possible strings, so length adds more strength than a wider character set does.
Character sets
AlphabetOnly ticked sets are used. Symbols add strength, but some systems refuse them, so match what the destination accepts.
Entropy in bits
MeasureEvery extra bit doubles the guesses an attacker needs. The figure assumes the string was generated at random, as it is here.
Look-alike characters
ReadabilityRemoving I, l, 1, O, 0 and o costs a little entropy, and stops people misreading a code they have to type.
Not All Random Is Equal
General-purpose functions such as Math.random are built for speed and can be predicted from their output. A cryptographically secure generator is designed so that past values reveal nothing about the next one.
For anything that protects access, only the second kind will do. This tool uses crypto.getRandomValues, which is backed by your operating system.
What Modulo Bias Is
A random byte has 256 values. Mapping it onto, say, 62 characters with a remainder makes the first few characters slightly more likely, because 256 does not divide evenly by 62.
Rejection sampling fixes that: bytes above the largest even multiple are thrown away and redrawn, so each character has exactly the same chance.
Where Random Strings Trip People Up
A good generator is only half of it. How you handle the result matters too:
- Do not reuse a secret. One value per system means one leak does not open everything.
- Do not commit secrets. A key in a repository stays in its history, even after you delete it.
- Length limits can truncate silently. Some systems cut long passwords without saying so, so test the value you set.
- Need an identifier and not a secret? A UUID has a standard format that databases and libraries already understand.
Why Real Randomness Matters
Guessing attacks
A short or predictable token can be found by trying values, however well the rest of a system is built.
Credential reuse
Generating a fresh value is quicker than remembering one, which removes the temptation to reuse.
Collisions
Short IDs clash sooner than intuition suggests. Enough entropy keeps them unique.
Human patterns
People choose words, dates and keyboard runs. Attackers try those first, and random strings have none of them.
Who Generates Random Strings
Anyone who needs a value nobody can guess.
Developers & IT
Create API keys, app secrets and test values without leaving the browser.
For IT & MSPsSecurity Teams
Rotate secrets with values whose strength you can state in bits.
For brand protectionRelated Tools
More utilities, and the monitoring behind them.
Check a certificate
See who issued a site's certificate and when it expires.
SSL certificate checkerMonitor your domains
Get an alert when a domain's expiry, DNS or certificate changes.
See domain monitoringFrequently Asked Questions
Common questions about random strings.
Are these strings really random?
They come from crypto.getRandomValues, your browser's cryptographically secure generator, which is seeded by the operating system.
Can I use this as a password generator?
Yes. Sixteen or more mixed characters, stored in a password manager, makes a strong password.
Does Domainyze see what I generate?
No. Strings are created on your device and are never sent to us.
What does entropy mean here?
It is the number of bits of unpredictability in a string: length multiplied by the base-2 logarithm of the alphabet size. Each extra bit doubles the guessing work.
How long should an API key be?
At least 128 bits of entropy. With letters and digits that is 22 characters, and 32 gives a comfortable margin.
Why exclude look-alike characters?
Characters such as l, 1, O and 0 are easily confused when someone reads a code aloud or retypes it.
Which symbols are included?
A set that is usually safe in config files and forms: ! # $ % & * + - = ? ^ _ ~. Quotes and backslashes are left out because they tend to need escaping.
Do you keep a history?
No. Reload the page and the strings are gone, so copy what you need.
Start Monitoring & Catching Domains Today
Join founders, agencies, and domainers already protecting their portfolio. Your first 5 domains are free.
No credit card required • Cancel anytime
Guides for domain operators
Deep dives on domain names, DNS, SSL, acquisitions and portfolio management.
All guides →
4 Letter Domains: The Complete LLLL Investing Playbook
4 letter domain names represent one of the most liquid segments of the domain aftermarket. All 456,976 possible .com combinations are registered.
.SI Domain: Slovenia's 30-Year-Old ccTLD Is Suddenly Super Intelligence
What is the .SI domain? Learn how Slovenia's country-code TLD went from 10 registrations in 1992 to a 2,199% surge in September 2026, and why 'super intelligence' made .SI the new .AI.
Infringing Domains: Detecting, Monitoring, and Recovering
Your domain is your storefront. Every day, someone registers a lookalike of it, to skim your traffic, phish your customers, or hold it for ransom. This guide covers what infringing domains are, how to find them before they hurt you, and exactly what to do when you do.