How to Generate a Random String of Fixed Length in Go

By the end of this page, you will understand how to generate random strings in Go, how to limit the characters to uppercase and lowercase letters only, and when to choose a simple approach versus a more secure one.

Random string generation in Go usually means:

• choosing a set of allowed characters
• picking characters from that set at random
• repeating until the string reaches the required length

For this question, the allowed character set is only letters:

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ

The core idea is that a random string is built one character at a time. For each position in the string, your program randomly selects one character from the allowed alphabet.

This matters in real programming because random strings are often used for:

• temporary identifiers
• invite codes
• test data
• filenames
• mock tokens

In Go, there are two common ways to generate random values:

• math/rand for general-purpose pseudo-random values
• crypto/rand for security-sensitive randomness

If you only want a simple random-looking string for testing or non-sensitive use, math/rand is often enough. If the string is used for passwords, reset tokens, API secrets, or anything security-related, use crypto/rand instead.

A fixed-length random string is not about generating one random word. It is about repeatedly sampling from a known alphabet until you have enough characters.

Imagine you have a bag containing 52 tiles:

• 26 lowercase letters
• 26 uppercase letters

To build a random string of length 8:

1. reach into the bag
2. pick one tile
3. write it down
4. put the tile back
5. repeat 8 times

That is exactly what the code does. The string length tells you how many picks to make, and the alphabet string is the bag of available characters.

Basic approach with math/rand

package main

import (
	"fmt"
	"math/rand"
	"time"
)

const letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"

func randomString(n int) string {
	rand.Seed(time.Now().UnixNano())
	b := make([]byte, n)
	for i := range b {
		b[i] = letters[rand.Intn(len(letters))]
	}
	return string(b)
}

func main() {
	fmt.Println(randomString(10))
}

How it works

• letters stores all allowed characters.
• make([]byte, n) creates space for n characters.
• rand.Intn(len(letters)) picks a random index.
• Each byte in b is filled with one random letter.
• string(b) converts the byte slice into a Go string.

Consider this function:

const letters = "abcXYZ"

func randomString(n int) string {
	b := make([]byte, n)
	for i := range b {
		b[i] = letters[rand.Intn(len(letters))]
	}
	return string(b)
}

If we call:

rand.Seed(1)
fmt.Println(randomString(4))

Here is the step-by-step idea:

1. letters contains 6 possible characters:

   • a
   • b
   • c
   • X
   • Y
   • Z

2. make([]byte, 4) creates a byte slice with space for 4 characters.

Random fixed-length letter strings are useful in many situations:

• Test data generation
  • Create fake usernames like AbCdEf.
• Temporary file labels
  • Generate readable suffixes for filenames.
• Invite or referral codes
  • If security is not critical, a short random letter code may be enough.
• Mock API responses
  • Simulate IDs or labels in development.
• Games and simulations
  • Generate random names, room codes, or labels.

If the string protects access to something important, do not use math/rand. Use crypto/rand instead.

In real projects, developers usually wrap this logic in a small helper function so it can be reused across the codebase.

Common patterns include:

Validation

Check that the requested length is valid.

func randomString(n int) string {
	if n <= 0 {
		return ""
	}

	b := make([]byte, n)
	for i := range b {
		b[i] = letters[rand.Intn(len(letters))]
	}
	return string(b)
}

Early return

Guard clauses keep the function simple.

if n <= 0 {
	return ""
}

Reusable alphabet configuration

Developers often make the allowed characters configurable.

func randomFromCharset(n int, charset string) string {
	 n <=  || (charset) ==  {
		 
	}

	b := ([], n)
	 i :=  b {
		b[i] = charset[rand.Intn((charset))]
	}
	 (b)
}

1. Seeding every time the function is called

This is a very common beginner mistake.

Problematic code

func randomString(n int) string {
	rand.Seed(time.Now().UnixNano())
	b := make([]byte, n)
	for i := range b {
		b[i] = letters[rand.Intn(len(letters))]
	}
	return string(b)
}

Why it is a problem

• It repeats work unnecessarily.
• Calls made very close together can behave poorly.
• Seeding should usually happen once.

Better

func main() {
	rand.Seed(time.Now().UnixNano())
	fmt.Println(randomString(8))
}

2. Using math/rand for secrets

Broken choice

// Not suitable for password reset tokens
code := randomString(32)

Why it is a problem

is predictable compared with cryptographic randomness.

math/rand vs crypto/rand

const letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"

Simple function

func randomString(n int) string {
	if n <= 0 {
		return ""
	}

	b := make([]byte, n)
	for i := range b {
		b[i] = letters[rand.Intn(len(letters))]
	}
	return string(b)
}

Seed once

rand.Seed(time.Now().UnixNano())

Secure version

• Use crypto/rand
• Return (string, error)
• Use it for tokens, secrets, and passwords

Rules to remember

• Use a fixed alphabet when you want only certain characters.
• Use math/rand for non-sensitive randomness.
• Use crypto/rand for security-sensitive randomness.

How do I generate a random string with letters only in Go?

Create a string containing all allowed letters, then repeatedly pick random indexes from it and build a result string.

Is math/rand good enough for random strings in Go?

Yes for testing, demos, and non-sensitive values. No for passwords, tokens, or anything security-related.

How do I include both uppercase and lowercase letters?

Use an alphabet like:

const letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"

Why should I seed math/rand only once?

Seeding initializes the pseudo-random generator. Doing it once is cleaner and avoids unnecessary repeated setup.

Should I use bytes or runes for this?

Use bytes if your alphabet is only ASCII letters. Use runes if you need Unicode characters.

What happens if the requested length is 0?

A good helper function should return an empty string.

How can I make the function reusable for other character sets?

Pass the character set as a parameter, such as randomFromCharset(n, charset).

• Pseudo-random number generation — random strings depend on selecting random indexes.
• math/rand in Go — commonly used for fast non-secure randomness.
• crypto/rand in Go — used when randomness must be secure.
• Slices in Go — byte slices are used to build the string efficiently.
• Strings in Go — the final result is created by converting bytes to a string.
• Guard clauses — useful for handling invalid lengths early.
• Error handling in Go — important when using crypto/rand.
• Bytes vs runes — helps explain why ASCII letters work well with []byte.