Random alphanumeric string
The default: uppercase letters, lowercase letters and numbers (A-Z, a-z, 0-9), 62 characters in total. It works almost everywhere, in URLs, file names, databases and config files, without any escaping.
Random String Generator
Need a random string for an API key, a JWT secret, a voucher code or test data? Pick the length and the characters and copy the result. One string, or up to 1,000 at once.
Strings are created right in your browser with a secure random generator and are never sent anywhere.
Generate random string
Result
Random strings
How long should a random string be?
The longer a string is and the more kinds of characters it uses, the harder it is to guess. These settings work for the most common uses.
| Use | Settings | Randomness |
|---|---|---|
| JWT secret (HS256) | 43 letters and numbers, or 64 hex | 256 bits |
| API key or access token | 32 letters and numbers | 190 bits |
| Session ID or CSRF token | 32 letters and numbers | 190 bits |
| Voucher or invite code | 8 to 12 uppercase letters and numbers, without look-alikes | 40 to 60 bits |
| File name or cache key | 16 lowercase letters and numbers | 82 bits |
Common uses
-
API keys and access tokens for development and testing
-
JWT and webhook signing secrets
-
Session IDs and CSRF tokens
-
Voucher, invite and referral codes
-
Unique file names, cache keys and reference numbers
-
Test data and placeholder values
Need a password?
For account passwords, the Password Generator is the better choice. It also creates passphrases and PINs and shows how strong each password is.
Looking for random words or sentences instead? Use the Lorem Ipsum generator.
Random string with letters, numbers, symbols or hex
The generator starts with letters and numbers. Switch characters on or off depending on where the string will be used.
Random string with special characters
Turn on symbols to add !#$%&()*+,-./:;<=>?@[]^_{}~. Each character then has more options, so the same length gives more bits of randomness. Quotes, backslashes, backticks, pipes and spaces are left out on purpose, because they most often break code, config files and command lines.
Random string of letters or numbers only
Turn off the groups you do not need. Keep only numbers for a numeric code or a test ID, only letters for a code without digits, or uppercase and numbers for a code that is easy to read out loud.
Random hex string
Turn on hex for the digits 0-9 and the letters a-f. Each hex character carries 4 bits, so 32 hex characters equal 16 random bytes and 64 equal 32 bytes. Many systems expect keys, tokens and IDs in this format.
Random code without look-alike characters
For voucher codes, invite codes and anything people type in or read from paper, turn on leave out look-alike characters. 0 and O, or 1, l and I then never appear, so nobody mixes them up.
Generate a random string in code
Inside a script or an app, use the secure random functions your language already has. Each example creates 32 characters or a secret from 32 random bytes.
- Python, 32 letters and numbers
import secrets, string alphabet = string.ascii_letters + string.digits print(''.join(secrets.choice(alphabet) for _ in range(32)))- Python, JWT secret (43 characters)
python3 -c "import secrets; print(secrets.token_urlsafe(32))"- JavaScript (browser, Node.js 19+)
const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; const limit = 2 ** 32 - (2 ** 32 % alphabet.length); let value = ''; while (value.length < 32) { const [n] = crypto.getRandomValues(new Uint32Array(1)); if (n < limit) value += alphabet[n % alphabet.length]; } console.log(value);- Node.js, 64 hex characters
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"- PHP, 32 hex characters
echo bin2hex(random_bytes(16));- Linux and macOS terminal
openssl rand -hex 32 LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 32; echo
Related Tools
More generators for test data, codes and placeholder content.
FAQ
Frequently asked questions
Can I use these strings as API keys?
For local development and testing, yes. For production API keys, use the token tools your framework or platform provides, such as Laravel Sanctum, Rails has_secure_token, Django REST Framework TokenAuth or Phoenix Token, and follow their documentation for storing, rotating and revoking tokens.
Can two generated strings be the same?
With 32 letters and numbers there are about 2 × 1057 possible strings, so a repeat is practically impossible. Short strings, such as 6 numbers, can repeat in larger batches, so check for duplicates if every value must be unique.
Are the strings sent to a server?
No. They are generated in your browser and are not saved or sent anywhere. Only your settings are remembered in this browser for next time.