Generate Random String

Generate random strings for passwords, PINs, voucher codes and IDs: choose letters, digits, symbols or your own characters, leave out look-alikes such as 0 and O, require one of each type, and add hyphens. Each string's strength is shown in bits.

Every allowed character equally likely at every position

Characters to use

Uppercase A–ZLowercase a–zDigits 0–9Symbols

Extra characters (optional)

Length (1–1024)

How many (1–1,000)

Hyphen every … characters (0 = off)

Only my characters Leave out look-alikes (I l 1 O 0 o) At least one from each set No duplicate strings

Characters in pool

Bits per character

5.95

Bits per string

95.3

Strength

Very strong

Generated on your device with crypto.getRandomValues(). Nothing is sent or stored.

How Strong Is a Random String?

A random string's strength depends on two things only: how many characters it can use and how long it is. Each character adds log₂(pool size) bits, and each extra bit doubles the number of guesses an attacker needs.

bits = length × log₂(number of allowed characters)

Entropy per character and length needed for 128 bits by character set
Characters allowed	Pool	Bits per char	16 chars give	Length for 128 bits
Digits	10	3.32	53.2 bits	39
Hex (0–9, a–f)	16	4.00	64.0 bits	32
Lowercase letters	26	4.70	75.2 bits	28
Crockford Base32	32	5.00	80.0 bits	26
Letters + digits, no look-alikes	56	5.81	92.9 bits	23
Letters + digits	62	5.95	95.3 bits	22
All printable ASCII	94	6.55	104.9 bits	20

For scale: an 8-character letters-and-digits password (47.6 bits) has 218 trillion possibilities, which a cracking rig testing 10 billion guesses a second against a leaked fast hash could try in about 6 hours. At 16 characters the same rig would need longer than the age of the universe. These figures only hold for random strings; a human-chosen password of the same length is far weaker.

Worked Example: A Wi-Fi Password You Can Type on a TV

A household wants a strong Wi-Fi password that guests can type on a smart TV with an on-screen keyboard, where symbols are buried in extra menus and 0/O mix-ups are common.

Step 1: Drop symbols and look-alikes

Letters + digits = 62 characters, minus I l 1 O 0 o = 56 characters (5.81 bits each)

Step 2: Choose the length

20 characters × 5.81 = 116 bits · WPA2 passphrases allow 8 to 63 characters, the usual router limit

Step 3: Make it readable

Hyphen every 5 → e.g. Rk7Fd-uZ2Wp-9hTqe-M3xVa (hyphens are part of the password if you keep them)

Length made up for the smaller alphabet: 20 characters from 56 is stronger than 16 characters from all 94 printable ASCII characters (104.9 bits), and far easier to type. The "Wi-Fi password" preset sets this up; add hyphens only if you'll also type them.

Password Rules: Length Beats Symbols

NIST's digital identity guidelines (SP 800-63B-4) changed the advice many sites still follow. Services should require at least 15 characters for a password used on its own (8 if it is one part of multi-factor sign-in), allow at least 64, and not impose composition rules such as "one uppercase, one digit, one symbol".

Plenty of sites still enforce those rules, which is what At least one from each set is for. It costs very little: for a 16-character password from all four sets, 82% of random strings already qualify, so the rule removes only about 0.3 bits. The page redraws any string that misses a set, so every valid string stays equally likely; the bits tile accounts for the rule exactly.

Store generated passwords in a password manager. A strong random string is only useful if it is unique to one site.

Codes People Read, Type and Say Aloud

Voucher codes, booking references and licence keys are read off paper, typed on phones and spelled out over the phone. Three habits reduce support calls:

Leave out look-alikes. 0/O, 1/l/I and o are the usual culprits.
Use one letter case. Uppercase letters plus digits, matched case-insensitively.
Group the characters. K7M4-R9AX is easier to copy than K7M4R9AX; strip hyphens and spaces before checking.

Douglas Crockford's Base32 alphabet is a well-tested choice: 0123456789ABCDEFGHJKMNPQRSTVWXYZ, which drops I, L, O and U. A decoder can even read a typed O as 0 and I or L as 1. To use it here, tick Only my characters and paste that alphabet in.

How Many Codes Before Two Match?

Random codes collide much sooner than the total number of possibilities suggests. Printing one million 8-character Crockford codes looks safe with 1.1 trillion possibilities, but the chance that at least two match is about 37%.

Chance of at least one duplicate among one million random Crockford Base32 codes
Code length	Possible codes	Chance of a duplicate in 1,000,000
8	1.1 trillion (32⁸)	36.5%
10	1.1 quadrillion (32¹⁰)	0.044%

No duplicate strings guarantees uniqueness within one list here. For codes issued over time, also enforce a unique constraint in your database and simply generate again on the rare clash.

Random Strings in Code, and a Shortcut to Avoid

Python

import secrets, string

alphabet = string.ascii_letters + string.digits
''.join(secrets.choice(alphabet) for _ in range(16))

JavaScript (browser or Node)

const alphabet = 'ABCDEFGHJKMNPQRSTVWXYZ23456789';
const limit = 256 - (256 % alphabet.length);   // avoid favouring early letters
let out = '';
while (out.length < 16) {
  const [b] = crypto.getRandomValues(new Uint8Array(1));
  if (b < limit) out += alphabet[b % alphabet.length];
}

Linux / macOS shell

LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 16; echo

Avoid the popular one-liner Math.random().toString(36).slice(2). Its length varies, it carries at most about 52 bits, and Math.random() is predictable once an attacker sees enough output, so it must never make passwords, tokens or reset links.

Frequently asked questions

Are the strings stored or sent anywhere?

No. They are generated in your browser with crypto.getRandomValues() and disappear when you leave or generate again. Copy any you want to keep into a password manager.

How long should a random password be?

At least 15 characters when it is the only thing protecting an account, per NIST SP 800-63B-4. 16 letters and digits give about 95 bits, which is more than enough.

Can I use accented letters or emoji?

Yes, type them into the characters box. Check the system accepts them first: some fields reject non-ASCII characters, and an emoji can count as two or more characters in some software.

Why does the strength drop when I leave out look-alikes?

There are fewer characters to choose from, so each one carries slightly fewer bits. Add one or two characters of length to make up the difference.

Sources

NIST SP 800-63B-4: Authentication and Authenticator Management: 15-character minimum for single-factor passwords and no composition rules.
Douglas Crockford: Base 32: an alphabet without I, L, O and U.
Python documentation: secrets module: secrets.choice and password recipes.
MDN: Crypto.getRandomValues(): the secure source used on this page.
MDN: Math.random(): does not provide cryptographically secure random numbers.

Create GUIDs for Microsoft and .NET fields.

Generate Random Binary Numbers

Generate binary numbers with a chosen bit length.

Generate Random Bitmap

Create a random pixel image and save it as a PNG.

Generate Random Bytes

Generate bytes in hex, Base64, or decimal format.

Generate Random Date

Pick a date between your chosen start and end dates.

Generate Random Decimal Numbers

Generate decimals with a chosen range and precision.

Browse all Measurements Tools →