Long random string generator
Up to 4,096 characters, generated in your browser. The default 128 letters and digits carry 762.1 bits.
More options
How long is long enough
Past a certain length, extra characters stop adding security. 256 bits is the level used for long-term keys, and 43 letters and digits already exceed it. Length beyond that is about fitting a format, filling a field, or testing how a system copes with size, not about making a secret harder to guess.
Type any length up to 4,096 into the box beside the slider. The slider stops at 128 so that it stays usable for the lengths people pick most often.
| Length | Bits | Typical use |
|---|---|---|
| 43 | 256.0 | The shortest string that matches a 256-bit key |
| 64 | 381.1 | Long API secrets and signing keys |
| 128 | 762.1 | The default here; fixtures and padding |
| 256 | 1,524.3 | Field length and buffer tests |
| 1,024 | 6,097.1 | Load and truncation tests |
| 4,096 | 24,388.4 | The maximum on this page |
Where long strings get cut off
Long random strings are most often made to test limits, and the limits are closer than most people expect. Each of these was checked against the specification, the documentation or the software itself.
- bcrypt only uses the first 72 bytes of a password. PHP password_hash accepted a 73-byte password on PHP 8.5, and the resulting hash also verified against its 72-byte prefix, so the extra byte was silently ignored. The Python bcrypt 5.0.0 library refuses anything longer than 72 bytes with an error instead.
- An HMAC-SHA256 key longer than 64 bytes is hashed down to 32 bytes before use, as RFC 2104 specifies. A 65-byte key produced exactly the same MAC as its own SHA-256 digest when checked in Python, so key material beyond 64 bytes adds nothing.
- RFC 6265 only requires browsers to support at least 4,096 bytes per cookie, measured across the cookie name, value and attributes together. A long random value in a cookie can be dropped by a browser that stops at that minimum.
- nginx reads request headers into buffers set by large_client_header_buffers, which defaults to 4 buffers of 8 kilobytes. A header longer than one buffer gets 400 Bad Request, and a request line longer than one buffer gets 414.
- Windows caps a user-defined environment variable at 32,767 characters, so a long secret passed through the environment has a hard ceiling there.
Generating long strings in code
In JavaScript, crypto.getRandomValues fills at most 65,536 bytes per call, so a long string has to be built from several calls. In Python, secrets.choice in a loop has no such limit. Both are shown below, and both were run: the JavaScript example builds 100,000 characters across several calls.
Long output is also where a biased mapping becomes visible. Taking byte % 62 makes the first eight characters of the alphabet 25 percent more likely than the rest, and over a few thousand characters a simple frequency count shows it. Every example here discards out-of-range values instead.
Doing this in your own code
Python 3.6+ - 4,096 characters
import secrets
import string
ALPHABET = string.ascii_letters + string.digits
# secrets.choice has no length limit. 4,096 characters is 24,388 bits.
print("".join(secrets.choice(ALPHABET) for _ in range(4096)))JavaScript - 100,000 characters in chunks
const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
function longRandomString(length) {
const n = ALPHABET.length;
const limit = 256 - (256 % n); // discard bytes at or above this
let out = "";
while (out.length < length) {
// getRandomValues fills at most 65,536 bytes per call.
const bytes = crypto.getRandomValues(new Uint8Array(Math.min(65536, (length - out.length) * 2)));
for (const b of bytes) {
if (b < limit) out += ALPHABET[b % n];
if (out.length === length) break;
}
}
return out;
}
console.log(longRandomString(100000));Questions
What is the longest random string I can generate here?
4,096 characters. Type the length into the number box next to the slider; the slider itself covers 1 to 128. For more than 4,096, use one of the code examples, which have no practical limit.
How many bits of entropy does a 128-character random string have?
With letters and digits, 128 x log2(62) = 762.1 bits. With lowercase hex it is 512 bits, and with the 94 printable ASCII characters it is 839.0 bits. Anything above 256 bits is far beyond what brute force can reach.
Is a longer password always more secure?
Only up to the limit of whatever stores it. bcrypt ignores everything after the first 72 bytes, and PHP password_hash accepts longer input without saying so. If a system hashes with bcrypt, characters past byte 72 add no strength.
Why does my long random string get cut off?
Usually a limit downstream: a database column shorter than the value, a cookie over 4,096 bytes, a header over the nginx default of 8 kilobytes, or an environment variable over 32,767 characters on Windows. Check the length that arrived against the length you generated.