Random String Generator

The presets, and what each is for

The bits-per-character column is what decides how long a value needs to be. Multiply it by the length to get the total entropy, which the line under the results does for you.

How long should a token be

For anything that acts as a bearer credential, meaning possession of the string is enough to gain access, aim for at least 128 bits. That works out at 32 hexadecimal characters, 22 letters-and-digits characters, or 26 Base32 characters. Below about 80 bits a determined offline attack becomes plausible, and there is rarely a good reason to go there.

Where the string is only an identifier and not a secret, the question changes from guessability to collisions, and much shorter values are fine. A 12-character letters-and-digits string gives about 71 bits, which will not collide in any realistic dataset.

UUID version 4

A UUID v4 is 128 bits of which 122 are random; the other six are fixed by the specification to mark the version and variant. That is why the thirteenth character is always 4 and the seventeenth is always 8, 9, a or b. Those constants are not a weakness, and a value that lacks them is not a valid v4 UUID.

Base32 and human-readable codes

The Base32 preset uses the Crockford alphabet, which excludes the letters I, L, O and U. The first three go because they are indistinguishable from 1 and 0 in most fonts, and U goes so a generated code is less likely to spell something unfortunate. Because those letters are absent, the digits 0 and 1 are unambiguous and stay in. What remains is exactly 32 characters, which is five bits each and therefore convenient arithmetic.

Use it for anything a person handles: a coupon code, a device pairing code, a recovery code read off a card. For a token that only ever moves between machines, the wider alphabet is strictly better because it packs more entropy into the same length.

Where the randomness comes from

Every value here is drawn from crypto.getRandomValues. The ordinary Math.random is not a cryptographic generator: it is fast and adequate for shuffling a list, and predictable enough that anything treated as a secret must not be built from it.

There is a subtler point as well. Reducing a random number into an alphabet with a plain modulo makes the first few characters slightly more likely than the rest whenever the alphabet size does not divide the range evenly. Values that would introduce that bias are discarded and redrawn here, so the distribution is genuinely flat.

How to use it

Pick a preset, set the length, and press Generate. Choosing Custom alphabet lets you supply your own characters; duplicates are removed so a repeated character cannot skew the distribution. Copy all puts every result on the clipboard one per line, and Download saves them as a text file.

Questions

Related tools

Browse all Sigma Wire tools - every free tool on the site, grouped by category.