Random String Generator — 16, 32, 64 or 100 Characters
Generate a cryptographically secure random alphanumeric string at 16, 32, 64 or 100 characters, adjustable in one click. Free random string generator.
🔒 100% Client-Side Processing
Your data is processed entirely in your browser and never transmitted to any server.
Example
Input
Length: 16 Output
Ke6Nit2ldIqyYrxh Sixteen characters drawn from the 62 uppercase, lowercase and digit symbols, worth about 95 bits of entropy. Every click produces a different string, so yours will not match this one.
characters
Common Use Cases
Quick test identifiers
Generate throwaway keys, coupon codes, and record IDs for fixtures and demos.
Temporary passwords
Issue one-time alphanumeric credentials for test accounts (use the Secure Password Generator for real ones).
Correlation and idempotency keys
Tag a request so the same call retried twice is recognised as one, and so a single trace can be followed across services in the logs.
Frequently Asked Questions
- What characters can appear in the string?
- Uppercase letters, lowercase letters, and digits — 62 possible characters per position. At the default 16-character length that is roughly 4.7 × 10^28 combinations (about 95 bits of entropy); longer lengths add proportionally more.
- Can I use these strings as API keys or tokens?
- Yes — each character is drawn using the browser's cryptographically secure crypto.getRandomValues(), the same source used by the Secure Password Generator, so it is suitable for production secrets as well as test data.
- Why offer only 16, 32, 64, or 100 characters instead of any custom length?
- Those four lengths cover the overwhelming majority of real use cases — short tokens, standard API keys, and long test fixtures — while keeping the control simple. Paste the output into the Strip Punctuation or Remove Numbers tools first if you need a trimmed variant.
- How do I generate a random 32-character string?
- Pick 32 from the length control and one is produced immediately. At 62 possible characters per position that carries about 191 bits of entropy, which is far beyond what a database identifier or a coupon code needs and is a common default for API keys.
- Is one of these long enough to sign a JWT?
- Depends which length you pick. HS256 is specified against a secret at least as long as its output, meaning 256 bits, and a 32-character alphanumeric string carries about 191 bits, so it falls short of that bar. The 64-character option is worth roughly 381 bits and clears it comfortably. Choose 64 for signing keys and keep 16 or 32 for identifiers that do not need to resist offline attack.
- Is this as random as RANDOM.ORG?
- It is a different kind of random, and for keys the difference does not matter. RANDOM.ORG samples atmospheric noise, which is genuinely non-deterministic. This page uses crypto.getRandomValues, a cryptographically secure pseudorandom generator seeded from the operating system entropy pool. A CSPRNG is deterministic given its seed but computationally infeasible to predict without it, which is exactly the property a secret needs. Where true randomness earns its keep is lotteries and scientific sampling, not key generation.
- Could some characters turn up more often than others?
- No, and avoiding that took deliberate work. Each character is chosen from a random byte, but 256 does not divide evenly by the 62-character alphabet: under a plain remainder the first 8 characters would be reachable from 5 byte values each while the remaining 54 are reachable from only 4, making them 1.25 times more likely. This page discards any byte of 248 or above, leaving exactly four byte values per character, so the distribution is flat. Most one-line random-string snippets skip this step.
- How do I generate a random string in Python or JavaScript?
- In Python, secrets.choice draws without bias: ''.join(secrets.choice(string.ascii_letters + string.digits) for _ in range(16)) uses the same 62-character alphabet as this page. In JavaScript the widely copied one-liner maps crypto.getRandomValues through a remainder, which reintroduces the skew described above; keep the byte only when it is below 248 before taking the remainder, or draw more bytes than you need and discard the rest.
- Is my data private when I use this tool?
- Yes. This tool runs entirely in your browser using client-side JavaScript — nothing you type is transmitted to, logged by, or stored on any server. You can safely process confidential text, tokens, or code.