Java random string generator

import java.security.SecureRandom;

public class Main {
    private static final String ALPHABET =
        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
    // SecureRandom is thread-safe; create it once and share it.
    private static final SecureRandom RANDOM = new SecureRandom();

    static String randomString(int length) {
        StringBuilder sb = new StringBuilder(length);
        for (int i = 0; i < length; i++) {
            // nextInt(bound) discards out-of-range values, so there is no bias.
            sb.append(ALPHABET.charAt(RANDOM.nextInt(ALPHABET.length())));
        }
        return sb.toString();
    }

    public static void main(String[] args) {
        for (int i = 0; i < 3; i++) {
            System.out.println(randomString(24));
        }
    }
}

import java.security.SecureRandom;
import java.util.Base64;

public class Main {
    public static void main(String[] args) {
        SecureRandom random = new SecureRandom();
        byte[] bytes = new byte[32];
        random.nextBytes(bytes);

        // 43 characters, 256 bits, safe in URLs and headers
        System.out.println(Base64.getUrlEncoder().withoutPadding().encodeToString(bytes));

        // 64 hex characters, 256 bits
        StringBuilder hex = new StringBuilder(64);
        for (byte b : bytes) hex.append(String.format("%02x", b));
        System.out.println(hex);
    }
}

On Java 17 and later, HexFormat.of().formatHex(bytes) replaces the formatting loop.

import org.apache.commons.lang3.RandomStringUtils;

public class Main {
    public static void main(String[] args) {
        // secure() is backed by SecureRandom. It exists from 3.16.0 onward.
        System.out.println(RandomStringUtils.secure().nextAlphanumeric(24));
        System.out.println(RandomStringUtils.secure().nextAlphanumeric(24));
        System.out.println(RandomStringUtils.secure().nextAlphanumeric(24));
    }
}

Executed against commons-lang3 3.20.0. Avoid RandomStringUtils.insecure() for anything secret.

import java.security.SecureRandom;

public class Main {
    private static final String[] CLASSES = {
        "ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz", "0123456789", "!#$%*+-=?@^_"
    };
    private static final String ALPHABET = String.join("", CLASSES);
    private static final SecureRandom RANDOM = new SecureRandom();

    static String password(int length) {
        if (length < CLASSES.length) {
            throw new IllegalArgumentException("length is shorter than the number of required classes");
        }
        while (true) {
            StringBuilder sb = new StringBuilder(length);
            for (int i = 0; i < length; i++) {
                sb.append(ALPHABET.charAt(RANDOM.nextInt(ALPHABET.length())));
            }
            String candidate = sb.toString();
            boolean valid = true;
            for (String cls : CLASSES) {
                if (candidate.chars().noneMatch(c -> cls.indexOf(c) >= 0)) valid = false;
            }
            // Whole-string rejection keeps the result uniform over valid passwords.
            if (valid) return candidate;
        }
    }

    public static void main(String[] args) {
        for (int i = 0; i < 5; i++) System.out.println(password(20));
    }
}