Generating Random Strings in JavaScript: 5 Approaches with Code

How to generate a string of random characters in JavaScript? From simple to secure

Imagine: you are writing a registration form, and you need to generate a temporary password for a new user. Or, maybe you are creating a unique identifier for a session, an activation key, or just a random file name on the server. In all these cases, the same question arises: how to quickly and reliably generate a string of random characters in JavaScript?

This question is one of the most popular on Stack Overflow (thousands of views and dozens of answer options). But which approach to choose? In this article, we will break down 5 real ways to generate random strings, from the simplest to the cryptographically secure, and you will understand when to use which method.

Let's go! 🚀

Method 1: The Classic — Math.random() and toString(36)

The most concise method, often seen in Stack Overflow answers, is to use Math.random() together with toString(36).

How does it work? Math.random() returns a number from 0 (inclusive) to 1 (exclusive). The .toString(36) method converts this number to a string with base 36, meaning it uses digits 0–9 and letters a–z. Perfect for a quick result!

function randomString(length) {\n    let result = '';\n    const characters = 'abcdefghijklmnopqrstuvwxyz0123456789';\n    const charactersLength = characters.length;\n    for (let i = 0; i < length; i++) {\n        result += characters.charAt(Math.floor(Math.random() * charactersLength));\n    }\n    return result;\n}\n\nconsole.log(randomString(10)); // Example: "a3f8k2m9x1"\n

Pros and cons of this approach

\n
• Pros: Simplicity, clarity, works in any browser and Node.js.
\n
• Cons: Not suitable for cryptography (passwords, tokens). Math.random() is not cryptographically secure — it can be predicted.
\n

When to use: For generating random IDs in educational projects, file names, or test data. For production — only if security is not important.

Method 2: Short One-liner (but with a caveat)

A popular hack on the internet:

const randomStr = (length) => Math.random().toString(36).substring(2, 2 + length);\nconsole.log(randomStr(8)); // Example: "n4k9v3m2"\n

Looks elegant, but there's a catch. Math.random().toString(36) produces a string approximately 11–15 characters long. If you need 20 characters — this method won't work. Additionally, it is still not secure.

Conclusion: Good for quick prototypes, but not for serious tasks.

Method 3: Extended Alphabet and Character Control

What if you need not only letters and digits but also special characters? Or, conversely, you need to exclude similar characters (e.g., 0 and O, 1 and l)? For this, we write our own generator with a flexible character set.

function generateSecureString(length, includeSpecial = false) {\n    let chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';\n    if (includeSpecial) {\n        chars += '!@#$%^&*()_+-=[]{}|;:,./<>?';\n    }\n    let result = '';\n    const charsLength = chars.length;\n    for (let i = 0; i < length; i++) {\n        result += chars.charAt(Math.floor(Math.random() * charsLength));\n    }\n    return result;\n}\n\nconsole.log(generateSecureString(12, true)); // Example: "A3f!k2M9x1#"\n

Why is this useful?

\n
• You control the character set yourself.
\n
• You can exclude unreadable characters (e.g., for confirmation codes).
\n
• Easy to add support for digits, uppercase and lowercase letters.
\n

But remember: Math.random() is still not cryptographically secure. For passwords, it is better to use