Random String Generation with Uppercase Letters and Digits in JavaScript

By the end of this page, you will understand how to generate a random string of a fixed length from a custom set of allowed characters in JavaScript. You will learn how character pools work, how random indexing is used to pick characters, what common mistakes to avoid, and how this pattern is used in real applications such as invitation codes, temporary IDs, and test data generation.

A random string generator usually works by combining two simple ideas:

1. A character pool: the set of characters you allow.
2. Random selection: repeatedly pick one character from that pool until the string reaches the required length.

For this problem, the character pool is:

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ

That gives us 36 possible characters for each position in the string:

• 10 digits
• 26 uppercase letters

To generate a string of length N, you:

• start with an empty string
• repeat N times
• generate a random index between 0 and pool.length - 1
• append the character at that index

In JavaScript, Math.random() returns a number from 0 up to but not including 1. Multiplying it by the pool length gives a value in the correct range, and Math.floor() converts it into a valid array/string index.

This concept matters because many programming tasks require controlled random generation:

• verification codes
• coupon codes
• sample data
• test fixtures
• human-readable identifiers

It is also a great example of using loops, strings, indexing, and random number generation together.

Imagine a bag filled with tiles:

• 0 through 9
• A through Z

You close your eyes, pick one tile, write it down, put it back, and repeat until you have N characters.

That is essentially what the program does.

• The bag is the character pool.
• Each pick is a random index.
• Repeating the process N times builds the final string.

Because the tile is effectively available again on each pick, the same character can appear more than once, which is why outputs like U911K4 are valid.

The core idea in JavaScript looks like this:

function generateRandomString(length) {
  const chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
  let result = '';

  for (let i = 0; i < length; i++) {
    const index = Math.floor(Math.random() * chars.length);
    result += chars[index];
  }

  return result;
}

console.log(generateRandomString(6));

Example output:

4Z4UKK

How it works

• chars stores all allowed characters.
• result starts as an empty string.
• The loop runs length times.
• Each time, a random position is chosen from chars.
• That character is appended to result.
• After the loop finishes, the string is returned.

Consider this code:

function generateRandomString(length) {
  const chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
  let result = '';

  for (let i = 0; i < length; i++) {
    const index = Math.floor(Math.random() * chars.length);
    result += chars[index];
  }

  return result;
}

console.log(generateRandomString(3));

Suppose the random indexes chosen are:

12, 30, 5

Step-by-step trace

chars is:

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ

Index positions start at 0:

• 0 = 0
• =

Random uppercase-and-digit strings are commonly used when you need short, readable identifiers.

Common use cases

• Invitation codes
  • Example: AB39KQ
• Temporary reference IDs
  • Example: 7F2D1M
• Coupon or promo codes
  • Example: SAVE20 style systems may use similar generation rules
• Test data generation
  • Creating fake order numbers or sample tracking codes
• One-time user-facing tokens
  • Short strings shown in emails or dashboards

Why this format is popular

• Easy to read
• Shorter than long UUIDs
• Safer for manual entry than strings with lowercase and symbols
• Useful when users may type the code themselves

Important note

If the string is being used for security-sensitive purposes such as password reset tokens, API secrets, or authentication codes, Math.random() is usually not the right choice. In those cases, use a cryptographically secure generator such as crypto.getRandomValues() in the browser or crypto.randomBytes() in Node.js.

In real projects, developers usually wrap this logic in a reusable function and add validation around it.

Typical patterns

Input validation

function generateRandomString(length) {
  if (!Number.isInteger(length) || length < 1) {
    throw new Error('length must be a positive integer');
  }

  const chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';
  let result = '';

  for (let i = 0; i < length; i++) {
    const index = Math.floor(Math.random() * chars.length);
    result += chars[index];
  }

  return result;
}

This prevents invalid inputs like -2, 3.5, or 'abc'.

Configuration through a character set

function () {
   result = ;

   ( i = ; i < length; i++) {
     index = .(.() * chars.);
    result += chars[index];
  }

   result;
}

 code = (, );

Here are some frequent beginner mistakes.

1. Using Math.round() instead of Math.floor()

Broken code:

const index = Math.round(Math.random() * chars.length);

Why it is a problem:

• It can produce chars.length, which is out of range.
• That may give undefined.

Correct version:

const index = Math.floor(Math.random() * chars.length);

2. Forgetting to initialize the result string

Broken code:

let result;
result += 'A';

This can produce:

undefinedA

Correct version:

Here are a few useful comparisons.

Math.random() vs secure random

const chars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ';

function generateRandomString(length) {
  let result = '';

  for (let i = 0; i < length; i++) {
    const index = Math.floor(Math.random() * chars.length);
    result += chars[index];
  }

  return result;
}

Rules

• Use a character pool containing all allowed characters.
• Use Math.floor(Math.random() * chars.length) for a valid index.
• Loop exactly length times.
• Start with '' for the result string.

Good defaults

• Digits + uppercase letters:

'0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'

• Human-friendly set without confusing characters:

How do I generate a random string of a specific length in JavaScript?

Create a string of allowed characters, loop N times, choose a random index each time, and append that character to the result.

How do I include only uppercase letters and numbers?

Use a character pool like:

'0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'

Why do I use Math.floor() when picking a random character?

Because array and string indexes must be whole numbers from 0 up to length - 1. Math.floor() keeps the index in that valid range.

Can the same character appear more than once?

Yes. Each position is chosen independently, so repeated characters are normal.

Is Math.random() safe for generating verification or security tokens?

Not for high-security use cases. Use a cryptographically secure API for password reset tokens, secrets, or authentication codes.

How can I avoid confusing characters like O and 0?

Use a custom character pool that removes them, such as:

'23456789ABCDEFGHJKLMNPQRSTUVWXYZ'

• Math.random() — the core JavaScript function used for basic random number generation.
• for loop — commonly used to repeat character selection N times.
• Strings and indexing — needed to access characters by position.
• Arrays and join — an alternative way to build strings efficiently.
• Input validation — useful for checking that length is a positive integer.
• Guard clauses — a clean pattern for rejecting invalid input early.
• Cryptographically secure random values — important when randomness is used for security.
• UUIDs — another way to generate identifiers, though less human-friendly.