Random String Generator

Written byOleh Soloninupdated 5 October 2026

String length

How many

Alphabet

Advanced options

Prefix

Result

Resultgenerated in your browser…
Entropy, bits191
Alphabet size62

Random identifiers with the entropy stated

Generate random strings of any length from several alphabets, with an entropy estimate and an optional prefix.

Test fixtures, API keys and one-off identifiers all need strings that are unpredictable and the right shape for where they are going.

The entropy figure tells you how much randomness you are actually getting. A 32-character alphanumeric string carries about 190 bits, which is far beyond anything brute force can reach.

How to use

Set the length and how many strings you want — one string of 32 characters by default.
Pick the alphabet: letters and digits for API keys, hexadecimal for identifiers, URL-safe for tokens that travel in a link.
Add a prefix such as sk_live_ if you want one; it sits outside the random part and adds nothing to the strength.

What each alphabet buys you

Entropy is length times the base-2 logarithm of the alphabet size, so the alphabet only matters as much as its logarithm does. Going from 10 characters to 62 lifts each position from 3.3 bits to 5.95 — less than double.

The URL-safe alphabet has exactly 64 characters, so each one carries exactly six bits; hence the round 192 at length 32. That is also its practical appeal: such a string survives any link without percent-encoding.

Every figure comes from the generator on this page at length 32. The spread between the poorest and the richest alphabet is under a factor of two; length scales the result directly.
Alphabet	Characters	Entropy at length 32	Typical use
Digits only	10	106 bits	confirmation codes
Hexadecimal	16	128 bits	identifiers, anything paired with binary data
Letters only	52	182 bits	human-readable codes
Letters and digits	62	191 bits	API keys
URL-safe	64	192 bits	tokens inside addresses

How many characters to take

Pick the entropy the use calls for; 128 bits is a common target for long-lived secrets, and 256 bits is the choice when you want a wide margin. On letters and digits that is 22 and 43 characters.

Length scales entropy in proportion, which is why it is the lever that matters. Doubling the length doubles the bits, which squares the number of possibilities.

Every figure comes from the generator on this page. Eight characters is within reach of a determined search, so that length does not belong on a secret whatever the alphabet.
Length	Entropy on a 62-character alphabet
8	48 bits
16	95 bits
24	143 bits
32	191 bits
43	256 bits

What this calculator shows

Random strings at your chosen length and count
Alphabet options including hexadecimal and URL-safe
The entropy in bits, so the strength is explicit

What to keep in mind

Uses the browser's random generator and never sends anything to a server.
For production secrets, generating server-side with a cryptographic source remains the safer practice.

FAQs

How long should an API key be?

32 characters on letters and digits gives 191 bits, which is ample. If you want the round numbers, 43 characters gives 256 bits with a sliver to spare — 256.03, and 22 gives 131 — already past the 128-bit mark.

What does URL-safe mean?

A 64-character set in which nothing needs encoding inside an address: letters, digits, hyphen and underscore. Such a token can go straight into a link without turning into a run of percent groups.

What is entropy in bits?

The base-2 logarithm of how many strings are possible. Each bit doubles the search, so 128 bits is not twice 64 — it is 1.8 × 10¹⁹ times more work.

What is the prefix for?

So the key is recognisable in a log or in somebody else's code: sk_live_ names both the system and the fact that the key is a production one. It adds nothing to strength, since it is public, and it is excluded from the entropy figure.

Is this safe for production secrets?

The string comes from the browser's cryptographic generator and is never transmitted, so the value itself is sound. The caution is elsewhere: a secret that has passed through a clipboard and a browser window belongs in a secrets manager straight away, not in a chat thread.

How is this different from a UUID?

A UUID is a fixed format with pinned version and variant positions; the common version 4 carries 122 random bits, while other versions build the value from a timestamp or a name. Here the length and the alphabet are yours to choose, so a string can be made shorter or very much longer.

Worked example

An API key with a prefix

Input: 32 characters, alphanumeric, prefix sk_live_

Output: A key carrying about 190 bits of entropy

Note: The visible prefix is a convention worth copying — it makes a leaked key instantly identifiable in logs and code.

Useful links

All tools in Dev Tools

Random String Generator

Result

Related tools

UUID Generator

Password Generator

Online Hash Generator

Base64 Encoder / Decoder

Useful links