Java 隨機字串產生器：支援多種字元類型與長度自訂

前言

產生隨機字串是常見需求：驗證碼、臨時密碼、唯一代碼、測試資料等。本文提供一個功能完整、易於擴充的 PassWord 工具類，支援 8 種字元組合模式，長度可自訂，採用 SecureRandom 強化安全性。

完整程式碼

package com.example.util;

import java.security.SecureRandom;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;

public class PassWord {

    /** 字元類型枚舉 */
    public enum Type {
        LETTER,              // 小寫字母
        CAPITAL,             // 大寫字母
        NUMBER,              // 數字
        SIGN,                // 符號
        LETTER_CAPITAL,      // 大小寫字母
        LETTER_NUMBER,       // 小寫字母+數字
        LETTER_CAPITAL_NUMBER, // 大小寫字母+數字
        LETTER_CAPITAL_NUMBER_SIGN // 全組合
    }

    private static final String[] LOWER = {
        "a","b","c","d","e","f","g","h","i","j","k","l","m",
        "n","o","p","q","r","s","t","u","v","w","x","y","z"
    };
    private static final String[] UPPER = {
        "A","B","C","D","E","F","G","H","I","J","K","L","M",
        "N","O","P","Q","R","S","T","U","V","W","X","Y","Z"
    };
    private static final String[] DIGITS = {"0","1","2","3","4","5","6","7","8","9"};
    private static final String[] SIGNS = {
        "~","!","@","#","$","%","^","&","*","(",")","_","+","`","-","=",
        "{","}","|",":","\"","<",">","?","[","]","\\",";","'",",",".","/"
    };

    private static final SecureRandom RANDOM = new SecureRandom();

    /**
     * 產生隨機字串
     * @param length 字串長度
     * @param type 字元類型
     * @return 隨機字串
     */
    public static String generate(int length, Type type) {
        if (length <= 0) throw new IllegalArgumentException("長度必須大於 0");
        List<String> pool = new ArrayList<>();
        switch (type) {
            case LETTER: pool.addAll(Arrays.asList(LOWER)); break;
            case CAPITAL: pool.addAll(Arrays.asList(UPPER)); break;
            case NUMBER: pool.addAll(Arrays.asList(DIGITS)); break;
            case SIGN: pool.addAll(Arrays.asList(SIGNS)); break;
            case LETTER_CAPITAL:
                pool.addAll(Arrays.asList(LOWER));
                pool.addAll(Arrays.asList(UPPER));
                break;
            case LETTER_NUMBER:
                pool.addAll(Arrays.asList(LOWER));
                pool.addAll(Arrays.asList(DIGITS));
                break;
            case LETTER_CAPITAL_NUMBER:
                pool.addAll(Arrays.asList(LOWER));
                pool.addAll(Arrays.asList(UPPER));
                pool.addAll(Arrays.asList(DIGITS));
                break;
            case LETTER_CAPITAL_NUMBER_SIGN:
                pool.addAll(Arrays.asList(LOWER));
                pool.addAll(Arrays.asList(UPPER));
                pool.addAll(Arrays.asList(DIGITS));
                pool.addAll(Arrays.asList(SIGNS));
                break;
            default: throw new IllegalArgumentException("不支援的類型: " + type);
        }

        StringBuilder sb = new StringBuilder(length);
        for (int i = 0; i < length; i++) {
            sb.append(pool.get(RANDOM.nextInt(pool.size())));
        }
        return sb.toString();
    }

    // 測試主程式
    public static void main(String[] args) {
        System.out.println("純大寫 10 碼: " + generate(10, Type.CAPITAL));
        System.out.println("大小寫+數字 16 碼: " + generate(16, Type.LETTER_CAPITAL_NUMBER));
        System.out.println("全組合 24 碼: " + generate(24, Type.LETTER_CAPITAL_NUMBER_SIGN));
    }
}

使用範例

關鍵設計細節

1. 使用 SecureRandom：比 Random 更適合安全性敏感場景（密碼、Token），預設使用系統熵源。
2. 字元池動態組合：透過 List<String> 彈性組裝所需字元集，避免大量 if-else 重複程式碼。
3. StringBuilder 預設容量：建構時指定 length 減少擴容開銷。
4. 枚舉型別安全：編譯期檢查類型，避免字串常數拼寫錯誤。

進階擴充建議

• 排除易混淆字元：如移除 0/O、1/l/I、2/Z 等，提升人工辨識度。
• 支援自訂字元集：新增 generate(int length, String customCharset) 多載方法。
• 批次產生不重複碼：搭配 Set<String> 去重，適用於優惠券、序號生成。
• 效能優化：大量產生時可預先轉換為 char[] 陣列，直接索引取字元，減少物件建立。

常見問題

為什麼不用 Math.random()？

Math.random() 內部使用共享 Random 實例，多執行緒下有競爭問題，且非加密安全。

如何確保產生的密碼符合複雜度規則？

產生後檢查是否包含大寫、小寫、數字、符號；不符合則重新產生，或採用「保證至少各類一字元」演算法（先放入各類必備字元，再隨機填充剩餘長度，最後打亂順序）。

可用於 Session ID 或 CSRF Token 嗎？

可以，建議長度 ≥ 32 且使用 Type.LETTER_CAPITAL_NUMBER_SIGN，並搭配 HTTPS、HttpOnly、SameSite 屬性。

此工具類結構清晰、擴充性佳，可直接整合至專案中滿足各類隨機字串需求。