Random String Generator

Entropy, not length, is what matters

The strength of a random string is the number of possible values, which is the character set size raised to the length. A 16-character string from a 62-character alphanumeric set has about 95 bits of entropy; the same length from a 16-character hex set has 64. Doubling the alphabet adds one bit per character, while adding one character adds log2 of the alphabet size. Length is the more effective lever, which is why long strings from a small safe alphabet often beat short strings from an exotic one.

Choose the alphabet for where the string will travel

A string that will appear in a URL should avoid characters needing percent-encoding. One that might land in a filename should avoid slashes, colons and characters Windows rejects. One that a human might read aloud or retype should exclude lookalikes: l, 1, I, 0 and O. Base58, which is base62 minus those four, exists precisely for that reason and is what Bitcoin addresses use.

Unbiased sampling

Picking a character by taking a random byte modulo the alphabet size skews the distribution unless the alphabet size divides 256 evenly, which for 62 it does not. The correct approach rejects and redraws values that would introduce bias. The effect is small but real, and it matters for anything security-relevant.

Tokens are not passwords

A random string used as a session token, API key or reset link needs to be unguessable, which this provides. It also needs the surrounding handling: transmitted only over TLS, stored hashed rather than in plaintext, given an expiry, and made revocable. A strong token in a system with none of those properties is not secure.

Test data

Random strings make better fixtures than repeated placeholder text because they vary in length and content, which is what exposes truncation, encoding and layout bugs. Include the extremes deliberately: an empty string, a single character, and something far longer than the field expects.

Generated locally

Values come from the browser's cryptographic random source and are never transmitted.