Security🔒 Browser (client-side)API available📴 Works offlinebeginner

Random String

Generates random strings with a configurable character set.

Data stays in your browser

Ready to runInstant execution

Result

—

What does this tool do?

Generates random strings with a configurable character set.

Why would I use it?

You need tokens, salts or test data.
You want a random string without installing a CLI tool.
You are generating nonces for demos.

Real-life example

Input

length 16, alphanumeric

Output

kX7pQ2mZ9vR4tN1s

Uses crypto randomness when available.

Input → Process → Output → Next

Input: Set length and charset.
Process: The browser picks random characters.
Output: The random string.
Next action: Use it as a nonce or test value.

Common mistakes

Using Math.random() for security-sensitive strings.
Too short for tokens (use 32+ characters).
Reusing the same generated value.

What the result means

Output is uniformly random from the chosen alphabet.

Privacy & security

Your input is processed entirely in your browser and never sent to a YAS server.

API

Endpoint

POST https://yas.sh/api/v1/tools/random-string

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/random-string" \
  -H "Content-Type: application/json" \
  -d '{"length":32,"mode":"hex"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/random-string", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "length": 32,
  "mode": "hex"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/random-string", json={"length":32,"mode":"hex"})
data = r.json()

Field	Type	Required	Description
length	integer	No (default 16)	1–256
mode	string	No (default "alnum")	alnum \| alpha \| numeric \| hex

Success response

{ "slug": "random-string", "length": 32, "charset": "hex", "result": "<hex>" }

Random string from a named charset.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

Related tools

UUID Generator Password Generator