Random String Generator
Articles, guides, and in-depth tips for the Random String Generator — everything you need to get the most out of it.
✦ AI-powered — understands natural language
Your Token Generator Is Biased Even With a Secure Source
Why API Key Rotation Is Harder Than It Should Be — Zero-Downtime Rotation, Secure Distribution, and the Permanent Git History Problem
API key rotation is painful because most systems treat keys as static configuration — but rotation is the primary defence against undetected compromise. Here's the five-stage key lifecycle, why email and Slack are wrong distribution channels, the zero-downtime rotation sequence (generate new key, distribute, deploy, verify, then revoke old), why a Git-committed key is permanently compromised even if deleted from the latest version, and the secret scanning bots that find committed keys within seconds of push.
Why the Same Random Token Breaks in Some Contexts — Hex vs Base64url vs Standard Base64 Explained
URL-safe Base64, hex, and standard Base64 are different representations of the same randomness — and the wrong choice causes "invalid token" errors when + and / characters in standard Base64 get interpreted as spaces and path separators in URLs. Here's a decision table for token format by context, why prefixed tokens (sk_live_, ghp_) enable security scanner detection of committed secrets, and why you should store only the SHA-256 hash of tokens, never the raw token.
Random Strings for Test Data vs Security Tokens: The Difference That's Invisible in the Output
Generating a random string and generating a *secure* random string can look identical — but only one is safe as a session token or API key. Here's how CSPRNGs differ from standard PRNGs (Mersenne Twister can be fully reconstructed from 624 outputs), how alphabet choice affects entropy per character, why test data often needs structured fake data rather than random strings, and why "always use a CSPRNG" is often the simplest safe policy.
UUID v4 vs UUID v7 vs ULID vs NanoID: Which Identifier Format Should You Use?
UUID v4's random bits fragment database B-tree indexes, causing write amplification. UUID v7 adds a millisecond timestamp prefix to fix this. ULID is sortable and URL-safe without hyphens. NanoID is compact and customisable. Here's how each works and when to choose each format.
Secure Randomness: Why Math.random() Fails for Security Tokens — and the Right Alternatives
Math.random() in JavaScript is predictable from 128 observations. Python's random module explicitly warns it's not for security. Here's why PRNGs fail for tokens, the secure alternatives in every major language, and the specific bit lengths needed for different security contexts.
How Long Does a Random String Need to Be? The Birthday Problem Explained
How long does a random string need to be? The birthday problem shows that 6-character codes collide far sooner than most developers expect. Here's how to calculate the right length for tokens, IDs, and API keys.
Random String Generator — Secure Tokens, API Keys & Test Data
Learn when and how to generate random strings for session tokens, API keys, OTPs, and test data — what character sets to use, how long they should be, and what entropy actually means in practice.
