node-randomstring is a one-function generator for readable random values

A small generator with a default length of 32 and a wide charset list

node-randomstring is a JavaScript module for generating random strings, published to npm under the name randomstring, with the licence recorded as MIT and the package version at 1.3.2. The whole API is a single function, randomstring.generate, and its defaults are simple enough to state in one line. The length defaults to 32, the charset defaults to alphanumeric, the readable flag defaults to false, and the capitalization option defaults to null, which means no constraint beyond what the charset already gives. The calling style is CommonJS, so the module is required and then called.

var randomstring = require("randomstring");

randomstring.generate();
// >> "XwPp9xazJ0ku5CZnlmgAx2Dld8SHkAeT"

randomstring.generate(7);
// >> "xqm5wXX"

That second line is worth pausing on, because passing a bare number as the argument is not documented in the options list and yet it produces a string of exactly that length. The options object is the documented route, and the numeric shorthand is the shortcut that makes the common case one character shorter to type.

Seven named charsets, and custom sets on top of them

The charset option is the most flexible part of the API and the best documented. The named values are alphanumeric, which covers the digits, the lowercase letters and the uppercase letters, alphabetic for the letters only, numeric for the digits only, hex for the digits and the lowercase letters a to f, binary for 0 and 1, and octal for 0 to 7. Beyond the named ones there is custom, which takes any characters you supply, and an array form which combines any of the above. That array form is the one that reaches for unusual requirements, because you can ask for digits plus a punctuation character in a single string.

randomstring.generate({
  charset: 'alphabetic'
});
// >> "AqoTIzKurxJi"

randomstring.generate({
  charset: 'abc'
});
// >> "accbaabbbbcccbccccaacacbbcbbcbbc"

randomstring.generate({
  charset: ['numeric', '!']
});
// >> "145132!87663611567!2486211!07856"

The custom example makes the point about how the option works, since the charset of abc produces strings made only of those three letters, which is the kind of thing you need for a code that a human has to read aloud or type by hand.

Readable output drops the characters that get misread

The readable option exists because random strings end up in places where people look at them, and some characters are misread more often than others. The option excludes the poorly readable characters 0, O, I and l, and it defaults to false rather than true, which is the sensible default for a value used as a token rather than a code. Turning it on costs you entropy from the charset, so the choice is a trade between legibility and the size of the space the generator draws from. The other output control is capitalization, which takes lowercase or uppercase and, left at its default of null, imposes nothing. That option is what you would use when the string is going into a place where the case matters, for instance a base52 token that must be all one case, and it composes with the charset choice rather than replacing it.

The callback turns the call asynchronous

The generate function takes an options object and an optional callback, and the callback form switches to the asynchronous version of crypto.randombytes. That is the whole difference between the two forms, and the readme says as much. In practice the callback receives the generated string.

randomstring.generate({
  charset: 'abc'
}, cb);
// >> "cb(generatedString) {}"

This matters more than it looks for a library whose whole job is producing unpredictable values, because the asynchronous path does not block the event loop while it waits for random bytes. For a script that generates one string at startup, the difference is invisible. For a server that generates a token per request, the synchronous form puts a blocking call on the request path, and the callback form does not. The dependency that makes this work is a single package, randombytes at version 2.1.0, and the module entry point is the index.js file at the root, with the implementation in a lib directory.

The command line tool mirrors the options as flags

The package also installs a binary, which the package manifest maps to bin/randomstring, so it can be used without writing any code at all. Installing it globally gives you the command.

npm install -g randomstring

The command takes an optional positional length, and then keyword style flags in the form name=value. The examples show the three forms.

$ randomstring
> sKCx49VgtHZ59bJOTLcU0Gr06ogUnDJi

$ randomstring 7
> CpMg433

$ randomstring length=24 charset=github readable
> hthbtgiguihgbuttuutubugg

The first invocation prints a default length string, the second takes the positional length, and the third combines a length, a charset and the readable flag. The charset value in that third example is github, which is not one of the charsets listed in the API section of the readme, so the command line surface and the documented option list are not identical, and it is worth checking what the binary accepts before assuming the two match.

Tests run under mocha, and the module has almost no dependencies

The development setup is minimal and easy to read from the manifest. The only runtime dependency is randombytes, and the only development dependency is mocha at a caret range on the major version 10, with the test script being mocha with no arguments. The engines field says node with no version constraint, which is a permissive choice for a module that has no native parts.

npm install
npm test

The repository layout matches that simplicity, with an index.js at the root as the entry point, a lib directory for the implementation, a bin directory for the command line, a test directory, an examples directory that is currently empty apart from a placeholder file, a changelog, and the usual dotfiles plus a .github directory holding the CI workflow that the badge in the readme points at. The npm name and the repository name differ, which is a detail worth remembering if you are searching for the package, since the readme title uses node-randomstring while the installed package is randomstring and the version badge also refers to randomstring.

Where node-randomstring is the wrong choice

The first wrong case is generating a cryptographic token, because the module is a convenience wrapper over a random byte source and its charsets are designed to be readable and typeable, and a base64 or hex token from the platform's own crypto library is both simpler and harder to argue about. The second is a project already using a UUID or an ID library, since this module does one thing and a suite of general purpose identifier libraries does it with more options. The third is a codebase that has standardised on ES modules, because the usage shown is a CommonJS require and the package manifest points main at the index file without describing an exports map for module resolution. The fourth is a team that needs a documented charset beyond the ones listed, since the command line accepts a value the API section does not document, which suggests the surface grew faster than the documentation and is a reason to test rather than assume. The fifth is anyone who needs a long random value and reaches for the default of 32 characters from a restricted charset without checking the size of the resulting space.

Editorial conclusion

Developers who need a random string for an identifier, a sample value or a short code, and who want to pick the alphabet rather than accept a fixed encoding, are the people this module is for, and the array form of the charset option is the feature that saves the most time when you need digits plus a specific symbol. It is the wrong choice for a security token, where the platform's own crypto primitives give you a shorter and more defensible answer, and it is the wrong choice if you need a value with a precise entropy requirement, since the module does not state the size of the space it draws from. Check three things before you depend on it: that you are using the CommonJS require form shown in the readme, since the package manifest points main at the index file and does not describe an exports map for module resolution, that the charset you want from the command line is one the binary actually accepts, since the readme's example uses a charset value that the API section does not list, and whether the readable flag is right for your context, since it reduces the alphabet and therefore the number of distinct strings available. The licence is MIT, the package version is 1.3.2, the repository publishes no GitHub releases, and the last push was on 2026-10-01.

Frequently asked questions

Official sources

1. eliaskg/node-randomstring on GitHub
2. Issues
3. License: MIT
4. README