Is it actually random?

Yes, and from the strongest source a browser has. Each character comes from crypto.getRandomValues, the browser's cryptographic random number generator, with no seed, no server and no pseudo-random shortcut anywhere in the tool. The draw is then mapped onto your alphabet by rejection sampling rather than by a remainder, which is the part most tools skip: 2 to the power 32 is not a multiple of 62 or of 94, so taking the remainder would hand the first few characters of the alphabet one extra chance each. Draws that land above the last whole multiple of the alphabet size are thrown away and taken again instead, so inside the window that is used every character has exactly the same number of draws landing on it.

What is rejection sampling, and does the bias it avoids really matter?

A 32-bit draw is a number from 0 to 4,294,967,295, which is 2 to the power 32 values. To turn that into a position in an alphabet of 62 characters, the easy way is to take the remainder, but 2 to the power 32 divided by 62 leaves a remainder of its own, so a handful of characters would come up marginally more often than the rest. Rejection sampling defines a window that divides evenly by the alphabet size and discards any draw at or above it, then draws again. The bias avoided is tiny, far too small to see in a page of output, so it matters for one reason: this page says every character is equally likely, and that claim has to be exactly true rather than nearly true.

Can I use one of these as a password?

It is not what this page is built for, and the line under the tool says so. These are test strings and identifiers: fixtures for a database column, throwaway codes, sample keys. A password is a different job, because it also needs a length that suits the site, a place you trust to keep it and a policy about which symbols the site accepts, none of which this page knows anything about. The password generator on this site is the tool for that, and it reports the pool each draw came from. Nothing stops you copying a string from here, but you would be choosing a tool that answers a narrower question.

Are the strings in a batch unique?

Strings are independent draws; duplicates are possible and are not removed. Short strings over a small alphabet repeat readily. Longer strings reduce the probability but do not prove uniqueness. UUID v4/v7 also have collision limits; neither is a uniqueness certificate.

Which characters can I draw from?

The four sets are lower case a to z, capitals A to Z, the ten digits and the 32 ASCII punctuation symbols, which is 94 characters with everything on and 62 with letters and digits only. Anything you type into Your own is added after them, in the order you typed it, so an alphabet of 0123456789abcdef gives hexadecimal output and a custom set of your own letters works just as well. The exclude field then removes whatever you put in it, wherever it came from, and the Look-alikes button fills it with 0, O, 1, l and I for a code someone has to read off a screen and type somewhere else. Repeated characters are kept once, and a character that cannot be printed is dropped, so a string is always a single line you can paste anywhere.

How long can a string be, and how many can I ask for at once?

Up to 4,096 characters a string and up to 10,000 strings, with the whole batch capped at 1,000,000 bytes. A request past the byte ceiling is refused with the number of strings of that length that would fit, so nothing is ever silently truncated, and the readout shows the size of the output before you commit to it. Copy all puts the batch on the clipboard one string a line, and Download CSV writes a file with a string header and one row each, quoted the RFC 4180 way when a string contains a comma or a double quote, which it can when the symbol set is on.

Is anything I type or generate sent anywhere?

No. Everything happens in the page you are looking at: there is no upload, no account and no server that ever sees a character of it. The output is not put into an analytics event and is never written into the address bar, so it cannot leak through a shared link or a history entry. The page does remember your settings in this browser, and only your settings: the saved record is rebuilt field by field from a fixed list of options, so no generated string can reach storage even by accident. If site data is blocked the tool still works, it simply opens on its defaults next time.

How do I generate hexadecimal, binary or numeric strings?

Hex opens the exact alphabet 0123456789abcdef, Binary opens 01, and Numeric uses only digits. Alphanumeric opens uppercase letters, lowercase letters and digits. These workflows disable other sets and clear exclusions so a remembered alphabet cannot alter the preset. Change Length for 8, 16, 32, 64 or any whole count up to 4,096. Leading zeros are retained as characters; these are strings, not arithmetic numbers.

Can I generate Unicode strings or words?

Add printable Unicode code points in Your own and disable unwanted built-in sets. Length counts a supplementary character such as an emoji once, rather than counting its two UTF-16 code units. Control characters, unpaired surrogates and line separators are dropped from the alphabet. Combining sequences may have several code points. This tool draws characters rather than selecting dictionary words; use the passphrase or lorem ipsum workflows for words.

Does this make seeded output, an API or non-repeating strings?

No. It uses the browser cryptographic source with no user seed, remote API or reproducible sequence. Letters may repeat within a string and strings may repeat within a batch. Copy/export is a manual browser workflow, separate from JavaScript, Python, Java or database code generation.

Random String Generator

Every character here is drawn by your browser's own cryptographic generator, crypto.getRandomValues, and mapped onto your alphabet by rejection sampling rather than by a remainder, so each character of the pool is equally likely instead of the first few being very slightly favoured. Turn on any mix of the four sets (62 characters for letters and digits, 94 once the ASCII symbols join them), type characters of your own to add, and take any character back out with the exclude field, which is one tap for the look-alikes 0, O, 1, l and I. Strings run to 4,096 characters and batches to 10,000 strings, with the whole batch capped at 1,000,000 bytes: a larger request is refused with the number of strings that would fit rather than quietly cut short. Nothing you type and nothing drawn leaves this tab: there is no upload, no account and no analytics event carrying the output, and the only thing the page keeps between visits is your settings.

ReadyYour strings appear here

Drawn in this tab the moment the page is ready

Include

Your own

Exclude

Length

How many

Alphabet

62 characters

Length

Strings

Output

169 bytes

Three settings people come here for

32 hex charactersa custom alphabet of 0 to 9 and a to f
8 character codescapitals and digits, look-alikes removed
40 characters, all 94letters, digits and every ASCII symbol

The alphabet is built in order: the sets you turn on, then the characters you type in Your own, then everything in Exclude is taken back out. Duplicates are kept once, and a character that cannot be printed is dropped, so every string is one line you can paste anywhere. A batch is capped at 1,000,000 bytes: a larger request is refused with the number of strings that would fit, rather than quietly cut short.

Made here, kept here. Every character comes from crypto.getRandomValues on your own device, mapped onto your alphabet by rejection sampling, so no position in it is favoured. Nothing you type and nothing drawn is sent anywhere, put into an analytics event or written into a link, and the only thing this page remembers between visits is your settings.

Accuracy. Drawn from the browser's cryptographic random source with rejection sampling, so every character of your alphabet is equally likely. These are random strings for testing and identifiers, not a password policy: a strong password also needs a length and a store you trust.

Common questions

Is it actually random?: Yes, and from the strongest source a browser has. Each character comes from crypto.getRandomValues, the browser's cryptographic random number generator, with no seed, no server and no pseudo-random shortcut anywhere in the tool. The draw is then mapped onto your alphabet by rejection sampling rather than by a remainder, which is the part most tools skip: 2 to the power 32 is not a multiple of 62 or of 94, so taking the remainder would hand the first few characters of the alphabet one extra chance each. Draws that land above the last whole multiple of the alphabet size are thrown away and taken again instead, so inside the window that is used every character has exactly the same number of draws landing on it.
What is rejection sampling, and does the bias it avoids really matter?: A 32-bit draw is a number from 0 to 4,294,967,295, which is 2 to the power 32 values. To turn that into a position in an alphabet of 62 characters, the easy way is to take the remainder, but 2 to the power 32 divided by 62 leaves a remainder of its own, so a handful of characters would come up marginally more often than the rest. Rejection sampling defines a window that divides evenly by the alphabet size and discards any draw at or above it, then draws again. The bias avoided is tiny, far too small to see in a page of output, so it matters for one reason: this page says every character is equally likely, and that claim has to be exactly true rather than nearly true.
Can I use one of these as a password?: It is not what this page is built for, and the line under the tool says so. These are test strings and identifiers: fixtures for a database column, throwaway codes, sample keys. A password is a different job, because it also needs a length that suits the site, a place you trust to keep it and a policy about which symbols the site accepts, none of which this page knows anything about. The password generator on this site is the tool for that, and it reports the pool each draw came from. Nothing stops you copying a string from here, but you would be choosing a tool that answers a narrower question.
Are the strings in a batch unique?: Strings are independent draws; duplicates are possible and are not removed. Short strings over a small alphabet repeat readily. Longer strings reduce the probability but do not prove uniqueness. UUID v4/v7 also have collision limits; neither is a uniqueness certificate.
Which characters can I draw from?: The four sets are lower case a to z, capitals A to Z, the ten digits and the 32 ASCII punctuation symbols, which is 94 characters with everything on and 62 with letters and digits only. Anything you type into Your own is added after them, in the order you typed it, so an alphabet of 0123456789abcdef gives hexadecimal output and a custom set of your own letters works just as well. The exclude field then removes whatever you put in it, wherever it came from, and the Look-alikes button fills it with 0, O, 1, l and I for a code someone has to read off a screen and type somewhere else. Repeated characters are kept once, and a character that cannot be printed is dropped, so a string is always a single line you can paste anywhere.
How long can a string be, and how many can I ask for at once?: Up to 4,096 characters a string and up to 10,000 strings, with the whole batch capped at 1,000,000 bytes. A request past the byte ceiling is refused with the number of strings of that length that would fit, so nothing is ever silently truncated, and the readout shows the size of the output before you commit to it. Copy all puts the batch on the clipboard one string a line, and Download CSV writes a file with a string header and one row each, quoted the RFC 4180 way when a string contains a comma or a double quote, which it can when the symbol set is on.
Is anything I type or generate sent anywhere?: No. Everything happens in the page you are looking at: there is no upload, no account and no server that ever sees a character of it. The output is not put into an analytics event and is never written into the address bar, so it cannot leak through a shared link or a history entry. The page does remember your settings in this browser, and only your settings: the saved record is rebuilt field by field from a fixed list of options, so no generated string can reach storage even by accident. If site data is blocked the tool still works, it simply opens on its defaults next time.
How do I generate hexadecimal, binary or numeric strings?: Hex opens the exact alphabet 0123456789abcdef, Binary opens 01, and Numeric uses only digits. Alphanumeric opens uppercase letters, lowercase letters and digits. These workflows disable other sets and clear exclusions so a remembered alphabet cannot alter the preset. Change Length for 8, 16, 32, 64 or any whole count up to 4,096. Leading zeros are retained as characters; these are strings, not arithmetic numbers.
Can I generate Unicode strings or words?: Add printable Unicode code points in Your own and disable unwanted built-in sets. Length counts a supplementary character such as an emoji once, rather than counting its two UTF-16 code units. Control characters, unpaired surrogates and line separators are dropped from the alphabet. Combining sequences may have several code points. This tool draws characters rather than selecting dictionary words; use the passphrase or lorem ipsum workflows for words.
Does this make seeded output, an API or non-repeating strings?: No. It uses the browser cryptographic source with no user seed, remote API or reproducible sequence. Letters may repeat within a string and strings may repeat within a batch. Copy/export is a manual browser workflow, separate from JavaScript, Python, Java or database code generation.

Drawn from the browser's cryptographic random source with rejection sampling, so every character of your alphabet is equally likely. These are random strings for testing and identifiers, not a password policy: a strong password also needs a length and a store you trust.