What is a random alphanumeric string?
It's a string built only from letters and digits, A to Z, a to z and 0 to 9, with each character chosen at random. Leaving out symbols makes the result safe to drop into URLs, filenames, form fields and spreadsheet cells without escaping. This generator produces one string of 1 to 256 characters per click, using your browser's cryptographically secure randomness.
How to use it
- Set the Length slider (1 to 256 characters; 12 by default).
- Click Generate.
- Copy the string.
Two 12-character results from the tool: L4HOSZvChlkt and XqcnNboyS0TP. Notice that the first has one digit and the second has a zero that's easy to misread as the letter O. Both points come up again below.
How many strings are possible?
There are 62 characters, so each one adds log₂(62) ≈ 5.95 bits. A few lengths:
| Length | Possible strings | Bits |
|---|---|---|
| 6 | 5.68 × 10¹⁰ | 35.7 |
| 8 | 2.18 × 10¹⁴ | 47.6 |
| 12 (default) | 3.23 × 10²¹ | 71.5 |
| 16 | 4.77 × 10²⁸ | 95.3 |
| 22 | 2.71 × 10³⁹ | 131.0 |
| 32 | 2.27 × 10⁵⁷ | 190.5 |
At 22 characters you pass 128 bits, more than the 122 random bits in a version 4 UUID, in a string that's 14 characters shorter than the UUID's 36.
Codes, collisions and case
The question that matters for voucher codes, order references and invite codes is how likely it is that two of them come out the same. The birthday problem gives a rough answer:
- 10,000 codes of 6 characters: about a 0.09% chance of any duplicate.
- 100,000 codes of 6 characters: about 8%.
- 1,000,000 codes of 8 characters: about 0.23%.
Those figures assume case matters. Many systems quietly uppercase what customers type, and then only 36 characters count. One million 8-character codes in a case-insensitive system have roughly a 16% chance of a duplicate. Either way, the fix is the same: put a unique constraint on the column and regenerate on conflict, rather than trusting the odds.
Codes that people have to type
Random alphanumerics include characters that look alike in many fonts: 0 and O, 1, l and I, and sometimes 5 and S. For a code printed on a receipt or read out over the phone, that leads to support tickets. Two practical options:
- Use the generator for codes that are only ever clicked or pasted (links, API references, filenames).
- For codes humans type, use an alphabet that drops the confusing characters. Crockford's Base32, for example, leaves out I, L, O and U and is case-insensitive.
This tool always uses the full 62-character set, so it's best suited to the first case.
How the characters are chosen
Each position is an independent pick from the 62-character list, made with the site's randomInt helper. That helper draws 32-bit numbers from crypto.getRandomValues and rejects values that would favour some characters over others. The flip side of independent picks is that nothing forces variety: there's about a 12% chance a 12-character string has no digit, and about a 0.15% chance it has no uppercase letter.
Typical jobs for it
| Job | Suggested length |
|---|---|
| Short reference shown to customers | 8 to 10 |
| Coupon or invite code (pasted, not typed) | 10 to 12 |
| Unique filename or cache-busting suffix | 8 to 12 |
| Fixture IDs for tests | 12 to 16 |
| Unguessable token or link slug | 22 or more |
Related generators
When you need symbols too, or want to choose which character sets are used, the random string generator has toggles for each set. Letters alone come from the random letter generator. If the value protects an account, use the password generator. For identifiers in the standard 8-4-4-4-12 format, the UUID generator is the right tool.
Last updated