Random String Generator

Create a local random character string

Choose a length and at least one character set, optionally remove look-alike characters, then select Generate random string. Web Crypto supplies the random values; the result remains in this tab until you copy or replace it.

How characters are selected

The page builds an alphabet from the checked sets, removes ambiguous characters when requested, and samples that alphabet with crypto.getRandomValues(). Rejection sampling discards integer values outside an even multiple of the alphabet size, preventing the small selection bias caused by a direct remainder operation.

Worked example

Choose lowercase letters and numbers with length 16. The alphabet has 36 characters before ambiguous exclusions, and the tool returns a value such as k7m2q9c4x8v3b6za. Your output will differ. Selecting Generate again replaces it with a new independent string.

Understanding the entropy estimate

The displayed estimate is length multiplied by log base 2 of the available alphabet size. It describes the ideal search space only when every character is selected uniformly and independently, as this generator intends. It does not measure how safely a copied value is stored, transmitted, labeled, or used by another system.

Choosing character sets

Use only characters accepted by the destination. Symbols can strengthen a fixed-length search space but may cause trouble in shells, URLs, configuration files, or systems with undocumented restrictions. Excluding ambiguous characters helps with manual reading and transcription, though it slightly reduces alphabet size. Increasing length usually compensates more predictably.

Security scope and limitations

Web Crypto is suitable for security-sensitive random generation in supported browsers, but this page is not a password manager, secret vault, key-derivation tool, hardware random source, or compliance certification. A generated string may serve as a candidate password or token only if the receiving system accepts it and you protect it afterward. Use a password manager for account credentials and a platform's dedicated secret-management workflow for production keys.

Privacy and handling

Generation happens locally and this page does not send the result to a server. Browser extensions, screen capture, clipboard history, synced clipboards, logs, or the application where you paste can still expose it. Avoid copying a live secret through untrusted devices. Generate a new value if one is accidentally shared.