Random String and Token Generator

Create random strings for API keys, session tokens, test data or invite codes. Pick a character set or define your own, then generate up to 500 strings at once.

How to use the random string generator

Choose a character set, set the length of each string (1 to 1,024) and how many you need (1 to 500), then press Generate. Strings appear one per line, ready to copy into a config file, a seed script or a spreadsheet. The status line shows how many bits of randomness each string contains.

Base62 uses A-Z, a-z and 0-9: compact and safe almost everywhere, including URLs and file names.
Hex is the classic format for keys and IDs. Each character carries exactly 4 bits, so 64 hex characters equal 256 bits.
URL-safe is the Base64url alphabet with - and _, 6 bits per character.
Custom lets you type any alphabet, for example one without confusing characters for codes people type by hand. Duplicate characters are removed so that every character stays equally likely.

Strings are built with crypto.getRandomValues() and rejection sampling, so the output is unpredictable and unbiased. It is generated in your browser and never transmitted.

How long should a token be?

The randomness of a string is length × log₂(alphabet size) bits:

Format	Bits per character	Length for 128 bits
Hex	4	32
Base62	5.95	22
URL-safe	6	22
Digits	3.32	39

128 bits is a common minimum for secrets such as API keys, session IDs and password reset tokens: nobody can guess them, even with enormous computing power. For example, the default 32-character base62 string has about 190.5 bits. Short codes such as an 8-character invite code (about 48 bits in base62) are fine when the server limits attempts and the code expires.

Worked example

To create a 256-bit secret for signing cookies or JWTs, choose Hex lowercase and length 64. The result looks like 9f2c4e… and can be used directly in an environment variable. To get the same strength in fewer characters, use URL-safe with length 43.

Common mistakes

Using Math.random() for tokens. Its output can be predicted from earlier values in some engines. Use a cryptographically secure generator, such as crypto.getRandomValues in browsers or secrets in Python.
Modulo bias with custom alphabets. Taking a random byte modulo 36 favours the first characters. This tool discards values that would cause bias.
Treating a timestamp or UUID as a secret. Timestamps are guessable, and UUIDs are designed as identifiers. Use a token with enough bits.
Storing tokens in plain text. If a token grants access, store only its hash on the server, just like a password.

Frequently asked questions

Are these random strings secure enough for API keys?

Yes, if they are long enough. They are produced with crypto.getRandomValues, a cryptographically secure source, without bias. Aim for at least 128 bits, for example 32 hex characters or 22 base62 characters.

What is the difference between base62 and Base64?

Base62 uses only letters and digits. Base64 adds two more symbols, + and / in the standard alphabet or - and _ in the URL-safe one. Random strings in base62 avoid characters that need escaping in URLs and file names.

How many bits of randomness does my string have?

Multiply the length by the base 2 logarithm of the number of distinct characters. The tool shows this value after every generation, for example about 190.5 bits for 32 base62 characters.

Can I generate strings without ambiguous characters?

Yes. Choose Custom and enter only the characters you want. The default custom alphabet already leaves out look-alikes such as 0, O, 1, I and L.

Why are duplicate characters removed from a custom alphabet?

A character that appears twice would be picked twice as often as the others, which reduces randomness. Removing duplicates keeps every character equally likely, and the tool tells you when it did so.