Are these strings genuinely random?

They come from your browser's cryptographic random source, which is seeded by the operating system's entropy pool and is the same source used for TLS keys. That is as good as randomness gets in software, and it is not the predictable generator ordinary application code usually reaches for.

How long should an API key be?

At least 128 bits of randomness — thirty-two hexadecimal characters, or twenty-two alphanumeric. That is comfortably beyond brute force, and the extra characters cost nothing since no human types an API key.

Which alphabet should I choose?

Hexadecimal when the value goes into a URL, a filename or a header and must never need escaping. Base58 when someone will read it aloud or retype it. Alphanumeric when you want density without punctuation causing trouble downstream.

Can two generated strings collide?

In theory, and in practice never at these lengths. With 128 bits you would need to generate about 2.6 × 10^19 values before a collision became likely, which is more identifiers than any system will ever mint.

Random String Generator

Random tokens, keys and IDs in the alphabet you choose.

Everything runs inside your browser. Your files never leave your device.

Result

The result appears here as you type.

Ask about Random String Generator

Questions about what this tool does, which option to pick, or what it can and cannot handle.

The question you type here is sent to an AI provider to be answered — your files and whatever you put in the tool above are not, and the assistant cannot see them. Answers are generated and can be wrong. The tool itself is not guessing: it runs deterministic code on your device.

About the Random String Generator

Sometimes what you need is not a password but a token: an API key for a service you are building, a random identifier for a test fixture, a nonce, a share code, a temporary slug. This produces those, in whichever alphabet suits where the value is going.

The randomness comes from your browser's cryptographically secure source, so these are safe to use as real secrets rather than only as placeholders. That is the difference between a generator like this and the quick approach of slicing a random floating-point number into a string, which produces values an attacker can predict from a handful of samples.

The alphabet is the choice that matters. Hexadecimal is the safest thing to put in a URL, a filename or a header, and never needs escaping. Alphanumeric packs more entropy into the same length and remains safe nearly everywhere. Base58 removes the characters people misread — zero, capital O, capital I, lowercase l — which is what you want on anything a human will read from a screen and type somewhere else. The full printable set is densest and the most likely to need escaping somewhere downstream.

Length should follow from purpose. Sixteen hexadecimal characters is 64 bits, ample for an identifier that only has to be unique. Anything acting as a bearer credential — an API key, a reset token, a signed download link — wants at least 128 bits, which is thirty-two hexadecimal characters, because that value is the only thing standing between a stranger and whatever it unlocks.

If what you need is a standard identifier rather than an arbitrary token, use the UUID generator instead: version 4 UUIDs carry 122 bits of randomness in a format every database and language already understands.

How to use it

1Set the length in characters, remembering that hexadecimal carries four bits per character and alphanumeric closer to six.
2Pick the alphabet to match the destination — hexadecimal for URLs and filenames, Base58 for anything read by a person.
3Generate as many values as you need; each one is drawn independently from the secure source.
4Copy the result. Nothing is kept once the page is closed, so paste it where it belongs before you leave.

Questions

Are these strings genuinely random?: They come from your browser's cryptographic random source, which is seeded by the operating system's entropy pool and is the same source used for TLS keys. That is as good as randomness gets in software, and it is not the predictable generator ordinary application code usually reaches for.
How long should an API key be?: At least 128 bits of randomness — thirty-two hexadecimal characters, or twenty-two alphanumeric. That is comfortably beyond brute force, and the extra characters cost nothing since no human types an API key.
Which alphabet should I choose?: Hexadecimal when the value goes into a URL, a filename or a header and must never need escaping. Base58 when someone will read it aloud or retype it. Alphanumeric when you want density without punctuation causing trouble downstream.
Can two generated strings collide?: In theory, and in practice never at these lengths. With 128 bits you would need to generate about 2.6 × 10^19 values before a collision became likely, which is more identifiers than any system will ever mint.