{randomstring:len}

Description

Returns a random string of the given length. The character set is fixed: 57 characters - lowercase a to x without q, y and z (23 letters), uppercase A to X without Y and Z (24 letters), and the digits 0 to 9. It is not a full alphabet, so do not use the result where every letter or a specific case must be possible. The output is regenerated on every render (the command is never cached), so the same template yields a different value each time and cannot be a deterministic test on its own. The length is the only argument; with no length, a zero length, or a length that is not a whole number greater than zero, the result is the empty string. Beware: a non-numeric length such as the word abc triggers an effectively endless loop and exhausts memory, so always pass a literal positive integer. For a configurable generator with more options see the AA_Generator_Rnd class.

Parameters

len optional default empty (no characters)

The number of characters to generate. Pass a literal positive whole number. With no value, a value of 0, or any value that is not a whole number greater than zero the result is the empty string. A non-numeric word (for example abc) must never be passed - it causes an endless loop that exhausts memory.

Examples

virtual{randomstring:8}

ExpectedaK3xR9pZ (8 random characters, different each render)

ActualNOsFQODa

The single argument is the length. {randomstring:8} returns 8 characters drawn from the fixed 57-character set. The value changes on every render, so it is shown here as an illustrative sample, not an asserted result.

virtual{randomstring:16}

Expected7mTQ2haK0xR4pBwf (16 random characters, different each render)

Actual7wSfBT8jVdciEXk5

A larger length produces more characters. {randomstring:16} returns 16 characters. Use a length that matches the strength you need (longer is harder to guess).

test{strlen:{randomstring:12}}

Expected12

Actual12

Although the characters are random, the length is exact, so it can be checked. Wrapping the call in {strlen:...} always returns the requested length (here 12). This is the deterministic, testable property of the command.

test[{randomstring:}] [{randomstring:0}]

Expected[] []

Actual[] []

With no length, or a length of 0, nothing is generated and the result is the empty string. The brackets here only frame the empty output so it is visible.

virtual<input type="hidden" name="token" value="{randomstring:32}">

Expected (the value is random)

(the value is random)">Actual

A common real use is a hard-to-guess token, for example a hidden form field or a one-time link parameter. {randomstring:32} gives 32 characters. Because the output is random it is illustrative, not asserted. Note this is not a cryptographic random source; for anything security-critical use a dedicated generator.

virtual{randomstring:40}

ExpectedA3KmBpRtSwGcD5HnJ4LvXx0e8u6bWf2iA1KoP7T (no q, y, z, Y or Z ever appears)

ActualO4h2lUp3BomcjxckiEH4glLFpjFw6MtEP6aUcfbW

The character set is not a full alphabet. It omits lowercase q, y and z and uppercase Y and Z, so those five letters never appear in the output. Do not rely on the result to contain every letter or to be evenly distributed across the whole alphabet.

← All expressions