About this random string generator
Developers need random strings all the time: API keys, session tokens, invitation codes, file names, and test data. This generator builds them from the characters you choose, using the browser’s cryptographic random number generator so the result is unpredictable, with every character drawn independently and with equal chance. You can make up to 50 strings at once, up to 256 characters long, from digits, lowercase and uppercase letters, and symbols, or switch to hexadecimal for keys and IDs. Each string shows its entropy, so you can tell at a glance whether it is long enough for its job.
How to generate random strings
- Set the size. Enter the Length of each string and How many strings you want, or press a preset such as API key.
- Choose the characters. Tick numbers, lowercase, uppercase, or symbols, or tick Hexadecimal only. Exclude look-alikes if people will read or type the strings.
- Press Generate strings. The strings appear with their entropy and estimated time to crack.
- Copy them. Press Copy next to one string, Copy all for the whole list, or Download to save them as a text file.
Frequently asked questions
How long should an API key or token be?
Aim for at least 128 bits of entropy. With letters and digits (62 characters) that is 22 characters, and in hexadecimal it is 32 characters. Longer is fine and costs nothing.
How is entropy calculated?
Entropy is the length multiplied by the base-2 logarithm of the number of possible characters. A 16-character string from 62 characters has about 95 bits, meaning an attacker faces 2 to the power of 95 possibilities.
Does every string contain each character type?
Not necessarily. Each character is picked independently, which keeps the full entropy, so a short string may have no digits. Use the Password Generator if a site requires every type.
What does excluding look-alikes change?
It removes i, l, 1, L, o, 0, and O, which are easy to confuse in many fonts. The pool gets smaller, so add a character or two of length to keep the same strength.
Is the hex option the same as a UUID?
No. A 32-character hex string has 128 random bits, while a version 4 UUID has 122 random bits plus fixed version digits and dashes. Use the UUID generator when a system expects that format.