Random String Generator

The first question to settle about any generated string is whether it needs to be unpredictable or merely unlikely to collide. A test fixture, a placeholder filename or a sample identifier only needs to be different from its neighbours. A session token, a password reset link or an API key must be unguessable by someone who has already seen a thousand previous outputs. Those are different requirements, and the difference is the random source rather than the length or the alphabet.

This tool uses the browser's cryptographically secure source, so its output is suitable for the second case as well as the first. That is a deliberate choice: it costs nothing here, and a generator that quietly used a weak source would be dangerous precisely because its output looks identical. Predictability is not visible by inspection, which is why the source matters more than anything you can observe about the result.

Alphabet and length together determine both collision resistance and unguessability. A 32-character string from a 62-symbol alphanumeric set carries around 190 bits, far beyond what any brute-force search reaches. Excluding visually ambiguous characters (0 and O, 1 and l and I) costs a fraction of a bit per character and is worth it for anything a person will read off a screen or dictate. Where the string will end up in a URL, restrict the alphabet to characters that need no percent-encoding, or the value that arrives will not be the value that was generated.