Random String Generation with Uppercase Letters and Digits in JavaScript

By the end of this page, you will understand how to generate a random string of a fixed length from a custom set of allowed characters in JavaScript. You will learn how character pools work, how random indexing is used to pick characters, what common mistakes to avoid, and how this pattern is used in real applications such as invitation codes, temporary IDs, and test data generation.

A random string generator usually works by combining two simple ideas:

1. A character pool: the set of characters you allow.
2. Random selection: repeatedly pick one character from that pool until the string reaches the required length.

For this problem, the character pool is:

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ

That gives us 36 possible characters for each position in the string:

• 10 digits
• 26 uppercase letters

To generate a string of length N, you:

• start with an empty string
• repeat N times
• generate a random index between 0 and pool.length - 1
• append the character at that index

In JavaScript, Math.random() returns a number from 0 up to but not including 1. Multiplying it by the pool length gives a value in the correct range, and Math.floor() converts it into a valid array/string index.

This concept matters because many programming tasks require controlled random generation:

• verification codes
• coupon codes
• sample data
• test fixtures
• human-readable identifiers

It is also a great example of using loops, strings, indexing, and random number generation together.

Imagine a bag filled with tiles:

• 0 through 9
• A through Z

You close your eyes, pick one tile, write it down, put it back, and repeat until you have N characters.

That is essentially what the program does.

• The bag is the character pool.
• Each pick is a random index.
• Repeating the process N times builds the final string.

Because the tile is effectively available again on each pick, the same character can appear more than once, which is why outputs like U911K4 are valid.

The core idea in JavaScript looks like this:

function generateRandomString(length) {
  const chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
  let result = '';

  for (let i = 0; i < length; i++) {
    const index = Math.floor(Math.random() * chars.length);
    result += chars[index];
  }

  return result;
}

console.log(generateRandomString(6));

Example output:

4Z4UKK

How it works

• chars stores all allowed characters.
• result starts as an empty string.
• The loop runs length times.
• Each time, a random position is chosen from chars.
• That character is appended to result.
• After the loop finishes, the string is returned.

Another example

console.log(generateRandomString(4));
console.log(generateRandomString(8));

Possible output:

A7Q1
9K2M1Z0P

The same function works for any positive length.

Version using an array and join

function generateRandomString(length) {
  const chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
  const result = [];

  for (let i = 0; i < length; i++) {
    const index = Math.floor(Math.random() * chars.length);
    result.push(chars[index]);
  }

  return result.join('');
}

This version is also valid and can be easier to extend later.

Consider this code:

function generateRandomString(length) {
  const chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
  let result = '';

  for (let i = 0; i < length; i++) {
    const index = Math.floor(Math.random() * chars.length);
    result += chars[index];
  }

  return result;
}

console.log(generateRandomString(3));

Suppose the random indexes chosen are:

12, 30, 5

Step-by-step trace

chars is:

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ

Index positions start at 0:

• 0 = 0
• 1 = 1
• 2 = 2
• ...
• 9 = 9
• 10 = A
• 11 = B
• 12 = C
• ...
• 30 = U
• 5 = 5

Now the loop runs:

1. First iteration

   • index = 12
   • chars[12] is C
   • result becomes "C"

2. Second iteration

   • index = 30
   • chars[30] is U
   • result becomes "CU"

3. Third iteration

   • index = 5
   • chars[5] is 5
   • result becomes "CU5"

After the loop ends, the function returns:

CU5

The important idea is that each character is chosen independently from the same allowed set.

Random uppercase-and-digit strings are commonly used when you need short, readable identifiers.

Common use cases

• Invitation codes
  • Example: AB39KQ
• Temporary reference IDs
  • Example: 7F2D1M
• Coupon or promo codes
  • Example: SAVE20 style systems may use similar generation rules
• Test data generation
  • Creating fake order numbers or sample tracking codes
• One-time user-facing tokens
  • Short strings shown in emails or dashboards

Why this format is popular

• Easy to read
• Shorter than long UUIDs
• Safer for manual entry than strings with lowercase and symbols
• Useful when users may type the code themselves

Important note

If the string is being used for security-sensitive purposes such as password reset tokens, API secrets, or authentication codes, Math.random() is usually not the right choice. In those cases, use a cryptographically secure generator such as crypto.getRandomValues() in the browser or crypto.randomBytes() in Node.js.

In real projects, developers usually wrap this logic in a reusable function and add validation around it.

Typical patterns

Input validation

function generateRandomString(length) {
  if (!Number.isInteger(length) || length < 1) {
    throw new Error('length must be a positive integer');
  }

  const chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
  let result = '';

  for (let i = 0; i < length; i++) {
    const index = Math.floor(Math.random() * chars.length);
    result += chars[index];
  }

  return result;
}

This prevents invalid inputs like -2, 3.5, or 'abc'.

Configuration through a character set

function generateRandomString(length, chars) {
  let result = '';

  for (let i = 0; i < length; i++) {
    const index = Math.floor(Math.random() * chars.length);
    result += chars[index];
  }

  return result;
}

const code = generateRandomString(6, '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ');

This makes the function reusable for other formats.

Guard clauses

Developers often fail early if inputs are invalid:

if (chars.length === 0) {
  throw new Error('Character set must not be empty');
}

Generating many codes

const codes = Array.from({ length: 5 }, () => generateRandomString(6));
console.log(codes);

This pattern is useful in admin tools, seed scripts, and test setup.

Avoiding ambiguous characters

Some codebases remove confusing characters like 0, O, 1, and I:

const chars = '23456789ABCDEFGHJKLMNPQRSTUVWXYZ';

That improves readability when humans must type the code manually.

Here are some frequent beginner mistakes.

1. Using Math.round() instead of Math.floor()

Broken code:

const index = Math.round(Math.random() * chars.length);

Why it is a problem:

• It can produce chars.length, which is out of range.
• That may give undefined.

Correct version:

const index = Math.floor(Math.random() * chars.length);

2. Forgetting to initialize the result string

Broken code:

let result;
result += 'A';

This can produce:

undefinedA

Correct version:

let result = '';

3. Looping the wrong number of times

Broken code:

for (let i = 0; i <= length; i++) {
  result += chars[Math.floor(Math.random() * chars.length)];
}

Why it is wrong:

• <= length runs one extra time.

Correct version:

for (let i = 0; i < length; i++) {
  result += chars[Math.floor(Math.random() * chars.length)];
}

4. Using the wrong character set

Broken code:

const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';

If you also need digits, this is incomplete.

Correct version:

const chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';

5. Assuming the output is unique

Random generation does not guarantee uniqueness.

If you generate many codes, duplicates can happen. In real systems, developers often:

• check whether the generated code already exists
• retry if needed
• store generated values in a database with a uniqueness constraint

6. Using Math.random() for secure tokens

For login tokens, password reset links, or API keys, use a secure random generator instead of Math.random().

Here are a few useful comparisons.

Math.random() vs secure random

Fixed character pool vs custom pool

const chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';

function generateRandomString(length) {
  let result = '';

  for (let i = 0; i < length; i++) {
    const index = Math.floor(Math.random() * chars.length);
    result += chars[index];
  }

  return result;
}

Rules

• Use a character pool containing all allowed characters.
• Use Math.floor(Math.random() * chars.length) for a valid index.
• Loop exactly length times.
• Start with '' for the result string.

Good defaults

• Digits + uppercase letters:

'0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'

• Human-friendly set without confusing characters:

'23456789ABCDEFGHJKLMNPQRSTUVWXYZ'

Watch out for

• Math.round() can create invalid indexes.
• <= length creates one extra character.
• Math.random() is not secure enough for sensitive tokens.
• Random output may contain duplicates across multiple generations.

Validation example

if (!Number.isInteger(length) || length < 1) {
  throw new Error('length must be a positive integer');
}

How do I generate a random string of a specific length in JavaScript?

Create a string of allowed characters, loop N times, choose a random index each time, and append that character to the result.

How do I include only uppercase letters and numbers?

Use a character pool like:

'0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'

Why do I use Math.floor() when picking a random character?

Because array and string indexes must be whole numbers from 0 up to length - 1. Math.floor() keeps the index in that valid range.

Can the same character appear more than once?

Yes. Each position is chosen independently, so repeated characters are normal.

Is Math.random() safe for generating verification or security tokens?

Not for high-security use cases. Use a cryptographically secure API for password reset tokens, secrets, or authentication codes.

How can I avoid confusing characters like O and 0?

Use a custom character pool that removes them, such as:

'23456789ABCDEFGHJKLMNPQRSTUVWXYZ'

How do I make sure generated codes are unique?

Random generation alone does not guarantee uniqueness. In real applications, check for duplicates in storage and retry if necessary.

Can I generate many random codes at once?

Yes. You can call the generator function repeatedly, for example with Array.from() or a loop.

• Math.random() — the core JavaScript function used for basic random number generation.
• for loop — commonly used to repeat character selection N times.
• Strings and indexing — needed to access characters by position.
• Arrays and join — an alternative way to build strings efficiently.
• Input validation — useful for checking that length is a positive integer.
• Guard clauses — a clean pattern for rejecting invalid input early.
• Cryptographically secure random values — important when randomness is used for security.
• UUIDs — another way to generate identifiers, though less human-friendly.