Random String Generator : Live Alphanumeric & Token Tool
Generate cryptographically unbiased random strings, alphanumeric tokens, and mock API keys in real time. Powered by your browser's native Web Crypto API with rejection sampling to eliminate statistical modulo bias.
To generate a cryptographically secure random string, select characters from a defined character pool using a Cryptographically Secure Pseudorandom Number Generator (CSPRNG) such as crypto.getRandomValues(). Applying rejection sampling ensures each character has an identical selection probability, preventing modulo bias vulnerabilities.
The Mathematics of Shannon Entropy in Random Strings
A random string's cryptographic strength is determined not by how complex it appears to human readers, but by its information entropy (H) measured in bits:
Where L is string length and N is the pool size of selectable symbols. Each character set expands the entropy space:
- Hexadecimal (16 Symbols): log2(16) = 4 bits per character. A 16-character hex token yields 64 bits of entropy.
- Standard Alphanumeric (62 Symbols): log2(62) ≈ 5.954 bits per character. A 16-character alphanumeric token yields ~95.3 bits of entropy.
- Full Complex Character Pool (94 Symbols): log2(94) ≈ 6.554 bits per character. A 16-character complex string yields ~104.9 bits of entropy.
Common Random Token Formats Reference Matrix
| Token Purpose | Recommended Length | Character Pool | Entropy Level |
|---|---|---|---|
| API Secret Keys | 32 Characters | Alphanumeric (A–Z, a–z, 0–9) | ~190.5 Bits (Maximum) |
| Session Identifier / Cookie | 24 Characters | Base64URL (A-Za-z0-9_-) | 144 Bits (OWASP Safe) |
| Cryptographic Salt | 16 Characters | Hexadecimal (0–9, A–F) | 64 Bits |
| Human Voucher / Promo Code | 8 – 12 Characters | Alphanumeric (No Ambiguous) | 46 – 69 Bits |
Why Naive Modulo Arithmetic Weakens Random Strings
A frequent bug in online string generators is using modulo division to select characters from a pool:
// Flawed implementation (Suffers from Modulo Bias): const char = pool[randomUint32 % pool.length];
Because 232 (4,294,967,296) is not evenly divisible by standard character pool sizes like 62 (alphanumeric), the remainder favors the first few characters in the pool. Over millions of iterations, characters like A, B, and C appear statistically more often than y or z.
Our generator uses rejection sampling: if a random 32-bit integer falls into the trailing remainder window, it is discarded and re-drawn, guaranteeing a mathematically uniform distribution across every symbol.
Related Random & Security Utilities:
- Secure Password Generator — Create high-entropy passwords with custom symbol and security rules.
- Random Number Generator — Unbiased random integers within custom ranges with no duplicates.
- UUID / GUID Generator — Generate standard 128-bit RFC 9562 identifiers client-side.
- Hardware Entropy vs. PRNG Guide — How cryptographic random generation works.
Frequently Asked Questions
Are the generated random strings cryptographically secure?
Yes. The tool relies exclusively on your browser's native Web Crypto API (crypto.getRandomValues), harvesting hardware entropy from the underlying operating system kernel (/dev/urandom or Windows CNG).
Why is Math.random() unsafe for generating tokens?
JavaScript's Math.random() uses deterministic pseudo-random algorithms (like XorShift128+). An attacker observing a small sequence of generated outputs can mathematically reconstruct the internal seed state and predict subsequent tokens.
What are ambiguous characters and why should I exclude them?
Ambiguous characters are visually similar glyphs—such as 0 (zero) and O (capital o), or 1 (one), l (lowercase L), and I (capital i). Excluding them prevents human transcription errors when users type voucher codes, recovery keys, or temporary passwords.
How many bits of entropy does an alphanumeric string have?
An alphanumeric pool (26 uppercase, 26 lowercase, 10 digits = 62 symbols) carries approximately 5.95 bits of entropy per character. A 16-character alphanumeric string provides ~95 bits of entropy.
Are my generated strings logged or stored?
No. All string generation executes 100% locally inside your browser's runtime memory. No strings are transmitted over an HTTP network or saved to any external database.