What does a random string generator do?
It builds a string of a chosen length where each character is picked at random from a pool you define. Here the pool is any combination of four sets: uppercase A to Z, lowercase a to z, digits 0 to 9 and 14 symbols. Lengths run from 1 to 256 characters, and the picks come from your browser's cryptographic random generator.
Setting it up
- Choose a Length from 1 to 256 (default 16).
- Tick the sets you want. Uppercase, Lowercase and Numbers start ticked; Symbols starts unticked.
- Click Generate and copy the result.
The four sets are joined into one pool and every character in that pool has the same probability at every position. Sets aren't weighted: with all four ticked, a digit has a 10 in 76 chance per position, the same as its share of the pool.
Same tool, different pools
Each of these came from a real run:
| Sets ticked | Length | Example |
|---|---|---|
| Upper, lower, numbers (default) | 16 | s0vY7GF7Jp93nU7k |
| All four | 16 | f7Alqz+N0Oy$HX&L |
| Numbers only | 10 | 5897994934 |
| Symbols only | 8 | )%**$%-- |
| None ticked (falls back to all four) | 10 | 4TNy#XpL$O |
Digits-only mode is handy for numeric codes and fixtures where leading zeros must survive (a code like 0042 is a string, not a number). Symbols-only mode is mostly a test tool: a string of nothing but special characters is a quick way to find code that forgets to escape them.
Pool size and strength
| Pool | Characters | Bits per character | Bits at 32 characters |
|---|---|---|---|
| Numbers | 10 | 3.32 | 106.3 |
| Symbols | 14 | 3.81 | 121.8 |
| Lowercase + numbers | 36 | 5.17 | 165.4 |
| Upper + lower | 52 | 5.70 | 182.4 |
| Upper + lower + numbers | 62 | 5.95 | 190.5 |
| All four | 76 | 6.25 | 199.9 |
A larger pool helps, but length helps more. Thirty-two digits carry more randomness than 16 characters from all four sets (about 100 bits).
Symbols and where they cause trouble
Twelve of the 14 symbols mean something special in at least one common context. That's useful when you're writing tests and a nuisance when you just want an ID. Look at f7Alqz+N0Oy$HX&L from the table above. Put it in a query string as ?token=f7Alqz+N0Oy$HX&L and a standard parser reads the token as f7Alqz N0Oy$HX: the + turns into a space and & starts a new parameter, so L is lost.
| Symbols | Why they can bite |
|---|---|
& = + # @ $ ! * ( ) |
Reserved or delimiter characters in URLs (RFC 3986, section 2.2) |
% |
Starts a percent-escape in URLs |
$ ! & * ( ) |
Expansion, history, background jobs, globbing and subshells in Unix shells |
^ $ * + ( ) |
Metacharacters in regular expressions |
- and _ |
Safe almost everywhere |
The fix is to encode, not to avoid testing. The URL encoder turns that example into f7Alqz%2BN0Oy%24HX%26L, which survives a query string intact. If you never want to think about escaping, untick Symbols or use the random alphanumeric generator.
Good uses
- Field-length and validation tests. Generate exactly the maximum length a column or form field allows (up to 256 here), then one more character, and check that the limit is enforced.
- Escaping tests. Feed symbol-heavy strings through templates, SQL query builders, CSV exports and shell scripts to catch missing escaping.
- Fixture values and IDs with a character set you control.
- Temporary secrets in development, such as a local signing key in an
.envfile.
How it's generated
The pool is built from the ticked sets, then each position gets an independent pick through a helper that draws 32-bit values from crypto.getRandomValues and uses rejection sampling to avoid favouring part of the pool. It all happens in the page; nothing is sent or saved.
For passwords specifically, the password generator is set up for that job, and the password strength checker can assess one you already have.
Last updated