Random String Generator
Uses crypto.getRandomValues with rejection sampling, so every character is equally likely.
How Random String Generator works
Generate random strings with your choice of character sets. Uses crypto.getRandomValues with rejection sampling, so every character is equally likely. Everything happens inside this page: the tool reads your input, runs the calculation or conversion locally, and hands the result back to you. Nothing is transmitted, because there is no backend to transmit it to.
That design choice is deliberate. Most free tool sites upload your files to a server, process them there, and quietly keep a copy. Toolcin cannot do that — the site is a set of static files. If your connection dropped the moment the page finished loading, every tool would still work.
Length, count, and the character pool
Length runs from 1 to 512 and you can generate up to 100 strings at once, which covers API keys, test fixtures and bulk invite codes. The pool is whatever character sets you leave ticked: lowercase, uppercase, digits, symbols.
Randomness comes from the browser's cryptographic source, so a generated token is not predictable from the clock or from the previous one — unlike Math.random, which is fine for a mock and wrong for a key.
How long should a token be
Each character adds log₂(pool) bits. With lowercase and digits the pool is 36, about 5.2 bits per character, so 16 characters is roughly 83 bits — comfortable for a session token. With all four sets the pool is about 86 and 16 characters gives over 100 bits.
Length matters more than exotic symbols: going from 16 to 24 characters at the same pool adds more strength than switching pools ever will.
| Pool | Bits per character | 16 characters |
|---|---|---|
| a-z | 4.7 | ≈ 75 bits |
| a-z, 0-9 | 5.2 | ≈ 83 bits |
| a-z, A-Z, 0-9 | 5.95 | ≈ 95 bits |
| All four sets | 6.4 | ≈ 103 bits |
Where these strings should not be used
A random string is an identifier, not a password hash and not an encryption key. If it protects an account, store only its hash server-side; if it encrypts data, generate it with a key-derivation function, not a character loop.
Good to know
- Works offline once loaded, including on flights and in locked-down networks.
- No file size limit beyond your device's own memory.
- Free to use, with no account and no usage counter.
- Results are produced locally, so they are not logged or shared with anyone.
Questions
Does this send anything to a server?
No — it runs entirely in your browser, so whatever you type stays on your device.
Can I use the output commercially?
Yes, output you generate is yours to use without attribution.
Are duplicates possible?
With 100 strings of 16 characters from an 86-character pool, collisions are astronomically unlikely — but check uniqueness if the strings are primary keys.
Can I exclude look-alike characters?
Not here; the password generator has that option.
Keep going
More generators tools
Passphrase Generator
Build a memorable passphrase from a curated word list. Long passphrases beat short complex passwords: four words already beat most eight-character strings.
Open toolMock Data Generator
Generate fake names, emails, phone numbers and cities for testing. Everything is fictional and generated locally — safe for demos and test databases.
Open toolPlaceholder Image Generator
Create placeholder images at any size with a custom label and colours. Perfect for wireframes, mockups and design hand-off.
Open toolWi-Fi QR Code
Create a QR code that joins a Wi-Fi network without typing the password. The code encodes the SSID and password in the standard WIFI: format phones understand.
Open toolvCard QR Code
Turn contact details into a scannable vCard QR code. Scanning adds you to the phone's address book without typing.
Open toolWheel Spinner
Spin a wheel of your own options and get a random winner. Add options one per line, spin, and the wheel picks a winner with an equal chance per segment.
Open tool