About the Random String Generator
This random string generator builds identifiers from the alphabet of your choice: letters and numbers, letters only, lowercase and digits, digits only, hexadecimal or Base58. Set a length anywhere from 4 to 128 characters, produce up to fifty strings per run, and optionally prepend a fixed prefix such as sk_test_ so the values are recognisable in logs. The details panel reports the alphabet size, the random length and the resulting entropy in bits, which is the number that actually tells you whether an identifier is long enough for the job you have in mind.
How to use the Random String Generator
- 1
Drag the Length slider to set how many random characters each string carries, from 4 to 128.
- 2
Enter How many strings to produce, up to fifty per run.
- 3
Choose an Alphabet — Letters and numbers, Letters only, Lowercase letters and numbers, Digits only, Hexadecimal or Base58.
- 4
Type an optional Prefix, press Generate, and check the entropy figure in the Details panel before copying.
What people use it for
Placeholder API keys in documentation
A prefix of sk_test_ with 24 alphanumeric characters produces a value that looks exactly like the real thing in a code sample while never being a working credential.
Short share codes and invite links
Base58 at 10 or 12 characters gives a code short enough to type off a screen and free of the characters people confuse when reading one out.
Hex identifiers for filenames
Thirty-two hexadecimal characters mirror the shape of an MD5 digest, which suits cache keys and generated asset filenames where a familiar format helps when debugging.
Numeric reference codes
The digits-only alphabet produces order references and support ticket numbers that fit fields expecting a purely numeric value.
Entropy, alphabet size and how long is long enough
Each character contributes log2 of the alphabet size in bits. Hexadecimal has 16 symbols and therefore carries 4 bits per character; Base58 has 58, giving about 5.86; the full alphanumeric set has 62, giving about 5.95. The usual target for an unguessable identifier is 128 bits, the same margin used for symmetric keys, which works out at 32 hex characters, 22 Base58 characters or 22 alphanumeric characters. For values that only need to avoid accidental collision rather than resist an attacker — cache keys, filenames, correlation IDs — 64 bits is ample and buys you an eleven-character alphanumeric string. Anything under about 40 bits is enumerable by anyone with patience and a script, so short random strings should never guard access to anything. The Details panel computes the figure for your current settings so you do not have to.
What Base58 is for
Base58 is ordinary Base62 with four characters removed: the digit zero, capital O, capital I and lowercase l. Satoshi Nakamoto introduced it for Bitcoin addresses and set out the reasoning in the source comments — those characters look alike in most fonts, and an address transcribed by hand or read aloud should not depend on the reader telling a one from a lowercase L. It also avoids characters that break double-click selection or get mangled when a line wraps. The cost is a slightly smaller alphabet and encoding arithmetic that is genuine base conversion rather than simple bit-slicing, which is why Base58 strings do not chunk neatly into bytes. Where sortability matters more than transcription, Crockford base32 is a better fit: it excludes I, L, O and U, treats visually similar characters as equivalent on decode, and preserves lexicographic order.
Why the prefix adds no security
A prefix such as sk_live_ or ghp_ is a constant, known to anyone who has ever seen one key from that service, so it contributes nothing to the entropy — a 24-character random portion carries the same bits with or without it. Prefixes exist for operational reasons, and they are genuinely valuable ones. They make a key identifiable at a glance in a log or a support ticket, they let you tell a test key from a live one before pasting it somewhere expensive, and above all they make secret scanning possible: GitHub, GitLab and most CI providers detect leaked credentials by matching known prefix patterns in commits, which only works because the fixed portion is distinctive. When designing your own key format, choose a prefix unlikely to occur in ordinary text and keep the random portion at 128 bits or more.
Tips
- Lengthen the string rather than switching alphabets when you need more entropy — length has by far the bigger effect.
- The prefix is excluded from the entropy figure and counted only in the total length shown beside it.
- Generate real production secrets server-side with crypto.randomBytes; this tool is seeded and therefore reproducible.