Random String Generator

PRACTICAL GUIDE · UPDATED OCTOBER 22, 2026

Random string generator: 16, 32 and custom lengths

The generator creates strings with selected character sets, length, count, and letter case, with a separate UUID option. It is useful for fictional IDs, documentation samples, and prototype data. A named preset is a convenience; it does not create a real credential with another service or replace that service's security workflow.

Generate a 16 or 32 character random string

Use 16 characters for a short demo reference or 32 characters when your destination needs a longer value. Both shortcuts select the length; choose Generate to create a fresh result. With General, letters and numbers, and mixed case, the result contains only A–Z, a–z and 0–9. Illustrative formats are aB7cD9eF2gH4jK6m (16 characters) and aB7cD9eF2gH4jK6mN8pQ0rS3tU5vW7xY (32). These fixed examples are not secrets.

Length alone does not guarantee suitability for passwords or tokens. Choose character rules your application accepts, and enforce uniqueness where required. For a UUID, enable Generate UUID v4; its hyphenated format has its own length.

Does this generate random words?

This tool generates character strings, not dictionary words or memorable passphrases. Use it when you need a specific character count rather than a word list.

Try a small batch

1. Choose General and select the needed character sets.
2. Enter a length such as 16 and a small count such as 3.
3. Select the required case.
4. Generate and inspect all results against your destination's rules.
5. Copy a result from its own output row or use Copy all for the batch. Clear results when you are finished.

The current interface limits ordinary string length to 4–256 characters and a batch to 1–20 results. UUID mode uses its own UUID representation rather than the selected ordinary-string length. Start with a few samples to catch a character-set mismatch before generating data for a larger fixture.

Presets and readable characters

Password and Token presets fill length, case and character-set controls; edit them before generating if your destination has different rules. Avoid similar characters excludes 0, O, 1, I, lowercase l and the vertical bar. Each character is drawn uniformly using secure browser randomness, or secure server randomness for the fallback. Selecting symbols permits them; it does not guarantee that every generated string includes every selected character class.

A fictional application example

Suppose a demo inventory table expects uppercase alphanumeric reference labels. Choose letters and numbers, uppercase case, and the required length. Confirm that no symbols appear. The example labels are for a prototype; the application's database should still enforce uniqueness if duplicate references are prohibited.

When a security-specific workflow is needed

The API Key preset generates text only. It does not register a credential, assign a scope, set an expiry, or enable revocation. For production secrets, use a vetted framework or provider's supported flow and protect the secret's lifecycle. Do not publish a real token in a bug report or tutorial. A random-looking identifier is also not an authorization rule.

Salts and password storage

Use your stack's established password-hashing implementation rather than constructing storage from a copied random string. A salt and a password have different purposes. See OWASP's password storage guidance when implementing that feature; this utility is not a password-hashing tool.

Review and retain only what you need

The normal client path uses browser randomness; server fallback routes can process generation requests. Use generated demonstration values only where their format and meaning fit.

Working with API data? Inspect the payload with the JSON formatter, or format your application code with the JavaScript formatter.