Random String Generator
Every character here is drawn by your browser's own cryptographic generator, crypto.getRandomValues, and mapped onto your alphabet by rejection sampling rather than by a remainder, so each character of the pool is equally likely instead of the first few being very slightly favoured. Turn on any mix of the four sets (62 characters for letters and digits, 94 once the ASCII symbols join them), type characters of your own to add, and take any character back out with the exclude field, which is one tap for the look-alikes 0, O, 1, l and I. Strings run to 4,096 characters and batches to 10,000 strings, with the whole batch capped at 1,000,000 bytes: a larger request is refused with the number of strings that would fit rather than quietly cut short. Nothing you type and nothing drawn leaves this tab: there is no upload, no account and no analytics event carrying the output, and the only thing the page keeps between visits is your settings.
Drawn in this tab the moment the page is ready
Three settings people come here for
The alphabet is built in order: the sets you turn on, then the characters you type in Your own, then everything in Exclude is taken back out. Duplicates are kept once, and a character that cannot be printed is dropped, so every string is one line you can paste anywhere. A batch is capped at 1,000,000 bytes: a larger request is refused with the number of strings that would fit, rather than quietly cut short.
Common questions
- Is it actually random?
- Yes, and from the strongest source a browser has. Each character comes from crypto.getRandomValues, the browser's cryptographic random number generator, with no seed, no server and no pseudo-random shortcut anywhere in the tool. The draw is then mapped onto your alphabet by rejection sampling rather than by a remainder, which is the part most tools skip: 2 to the power 32 is not a multiple of 62 or of 94, so taking the remainder would hand the first few characters of the alphabet one extra chance each. Draws that land above the last whole multiple of the alphabet size are thrown away and taken again instead, so inside the window that is used every character has exactly the same number of draws landing on it.
- What is rejection sampling, and does the bias it avoids really matter?
- A 32-bit draw is a number from 0 to 4,294,967,295, which is 2 to the power 32 values. To turn that into a position in an alphabet of 62 characters, the easy way is to take the remainder, but 2 to the power 32 divided by 62 leaves a remainder of its own, so a handful of characters would come up marginally more often than the rest. Rejection sampling defines a window that divides evenly by the alphabet size and discards any draw at or above it, then draws again. The bias avoided is tiny, far too small to see in a page of output, so it matters for one reason: this page says every character is equally likely, and that claim has to be exactly true rather than nearly true.
- Can I use one of these as a password?
- It is not what this page is built for, and the line under the tool says so. These are test strings and identifiers: fixtures for a database column, throwaway codes, sample keys. A password is a different job, because it also needs a length that suits the site, a place you trust to keep it and a policy about which symbols the site accepts, none of which this page knows anything about. The password generator on this site is the tool for that, and it reports the pool each draw came from. Nothing stops you copying a string from here, but you would be choosing a tool that answers a narrower question.
- Are the strings in a batch unique?
- They are drawn independently, so duplicates are possible rather than prevented. For anything of a reasonable length the chance is negligible: 16 characters from a pool of 62 is about 10 to the power 28 possibilities, so a batch of 10,000 will not repeat itself in practice. Short strings over a small alphabet are a different matter, and 4 characters from a pool of 10 has only 10,000 possibilities, so a batch of a few hundred can easily contain a duplicate. The tool does not remove duplicates, because quietly dropping a draw and replacing it would bend the even distribution the page promises. If you need a guaranteed-unique identifier, a v4 or v7 UUID is designed for exactly that.
- Which characters can I draw from?
- The four sets are lower case a to z, capitals A to Z, the ten digits and the 32 ASCII punctuation symbols, which is 94 characters with everything on and 62 with letters and digits only. Anything you type into Your own is added after them, in the order you typed it, so an alphabet of 0123456789abcdef gives hexadecimal output and a custom set of your own letters works just as well. The exclude field then removes whatever you put in it, wherever it came from, and the Look-alikes button fills it with 0, O, 1, l and I for a code someone has to read off a screen and type somewhere else. Repeated characters are kept once, and a character that cannot be printed is dropped, so a string is always a single line you can paste anywhere.
- How long can a string be, and how many can I ask for at once?
- Up to 4,096 characters a string and up to 10,000 strings, with the whole batch capped at 1,000,000 bytes. A request past the byte ceiling is refused with the number of strings of that length that would fit, so nothing is ever silently truncated, and the readout shows the size of the output before you commit to it. Copy all puts the batch on the clipboard one string a line, and Download CSV writes a file with a string header and one row each, quoted the RFC 4180 way when a string contains a comma or a double quote, which it can when the symbol set is on.
- Is anything I type or generate sent anywhere?
- No. Everything happens in the page you are looking at: there is no upload, no account and no server that ever sees a character of it. The output is not put into an analytics event and is never written into the address bar, so it cannot leak through a shared link or a history entry. The page does remember your settings in this browser, and only your settings: the saved record is rebuilt field by field from a fixed list of options, so no generated string can reach storage even by accident. If site data is blocked the tool still works, it simply opens on its defaults next time.
Drawn from the browser's cryptographic random source with rejection sampling, so every character of your alphabet is equally likely. These are random strings for testing and identifiers, not a password policy: a strong password also needs a length and a store you trust.