Random string generator
Random strings for tokens, salts, invite codes and test fixtures. Choose the alphabet and length; the entropy readout tells you how guessable each one is.
62-character alphabet × 16 = 95 bits of entropy per value.
Press generate to fill this table.
Picking an alphabet
- Base62 (A–Z, a–z, 0–9) is compact and safe almost anywhere.
- URL-safe adds
_and-, matching base64url (RFC 4648), for strings that go in URLs and filenames. - Crockford base32 leaves out I, L, O and U so codes survive being read aloud or typed by hand. It’s good for voucher and recovery codes.
- Hex is easy to parse and store as bytes; see the random hex generator for byte formats.
In code: crypto.getRandomValues() in JavaScript, secrets.token_urlsafe() in Python, SecureRandom in Java and Ruby. Avoid Math.random() and rand() for anything secret.
Questions people ask
How random are the strings?
Each character is picked independently and uniformly from your chosen alphabet using crypto.getRandomValues with rejection sampling, so the strings are suitable for secrets such as tokens, salts and invite codes.
How long should a random string be?
Multiply length by log₂ of the alphabet size to get entropy in bits. The page shows this for you. 128 bits (22 base62 characters) is the usual target for unguessable tokens; 64 bits is plenty for short-lived, rate-limited codes.
Can I use my own characters?
Yes. Choose “Custom…” and type any set of characters, including Unicode. Duplicates are removed so each distinct character is equally likely.