Make 1 to 1,000 random strings of up to 1,024 characters. Nothing leaves your browser.
A random string generator picks each character independently from the characters you allow, so with the default 62 characters (a to z, A to Z and 0 to 9) a 16-character string holds about 95.3 bits of choice, which is 16 times the base-2 logarithm of 62. Each pick asks the browser's secure random source, when available, for a whole number from 0 to the last position in the list, and uses that position, so no character is more likely than another. The characters are listed in a fixed order: lowercase, uppercase, digits, symbols, then your extra characters, with duplicates removed. Results are shown one per line. The tool does not force a string to contain one of each set. For a password, where each type must appear, use the password generator on this site.
Lowercase is a to z, uppercase is A to Z, digits are 0 to 9, and symbols are ! @ # $ % ^ & * ( ) - _ = + [ ] { } ; : , . ? / (24 in all). Extra characters are added to the sets that are on, up to 200 of them, and an emoji counts as one character even with a skin tone or as a joined family, because extra characters are split the way a person sees them. Turn all four sets off to use only your own, for example 01 for random binary strings or ACGT for DNA-like strings. Leave out look-alikes removes 0, O, 1, l and I from every set and from your extra characters, which takes the default pool from 62 to 57. This helps when people copy a code by eye. If every character is removed the tool says so and makes nothing.
With No repeated characters on, each character appears at most once in a string, as when you deal cards: the next character is drawn from those left. The length cannot be more than the number of characters to choose from, so 11 characters from 10 digits is an error that tells you the largest possible length. Make every string different compares whole strings and draws again on a match. It works out how many different strings are possible first: 10 digits at length 3 with no repeats give 10 times 9 times 8, which is 720, so asking for 1,000 unique strings shows an error instead of looping. Without the no-repeat rule the count is the number of characters to the power of the length.
Length goes from 1 to 1,024 characters and the count from 1 to 1,000, so one run can make about a million characters. Strings are made in your browser, in this tab. They are not uploaded, saved or put in the page address; only your choices, such as the length and the sets, are remembered in this browser. A random string is not a secret by itself: anything you paste into another page or chat is no longer private to you. For keys and tokens that guard real data, make them where they will be used.
Set Length to 32 and How many strings to 1, leave lowercase, uppercase and digits on, and press Generate. The result has about 190.5 bits of choice, which is 32 times log2(62). Copy result puts the string on the clipboard.
It can make a long random string, but it does not make sure a string holds a lowercase letter, a digit and a symbol, which many sites ask for. The password generator on this site does that, and also makes passphrases and PINs.
The five characters 0, O, 1, l and I, which are easy to mix up when typed by hand. They are removed from all sets and from your extra characters, so the default pool of 62 characters becomes 57.
A string cannot have more characters than there are different characters to choose from. With only the 10 digits on, the longest possible string is 10 characters, so a length of 11 shows an error. Turn on more sets, add extra characters or shorten the length.
Turn on Make every string different. For 1,000 strings of 8 lowercase letters a repeat is very unlikely anyway, but with 10 digits at length 2 there are only 100 possible strings, so asking for 101 unique ones shows an error with the number that is possible.
No. The strings are made in your browser, in this tab, and no server receives them. Your settings are saved in this browser, but the strings are not. Google Analytics counts visits, results and copy presses, never the strings.