How should I generate discount codes for my Shopify store?
How long it is, and which characters it may use.
Between 3 and 12. This is the only part of the code that carries any strength.
Drops O, 0, I, 1, L, S, 5, B, 8, Z, 2 and V — the characters people misread on a printed card or mishear on a call.
Letters and digits only, uppercased. It makes the code readable in a report. It adds no strength at all, because it is printed wherever the code is.
A hyphen between the prefix and the random part makes a long code easier to read back.
Everything runs in your browser. Nothing about this batch reaches us.
Up to 500 per batch, unique within the batch.
Set a length and a batch size, then press Generate codes. Nothing is generated — and nothing is shown here — until you do.
These are code strings, not live discounts. Nothing on this page can create a discount that works at your checkout — that needs a signed-in session for your specific shop. Paste these into Shopify Discounts to make them real.
These are strings, not live discounts.
Making them real needs a signed-in session on your own shop, which is why no public page can do it. Nudgesmart creates the code inside Shopify, one per visitor, single-use and on an expiry timer, at the moment the popup is converted.
How it's calculated
A discount code generator for a Shopify store builds readable one-off code strings from a fixed prefix plus random characters, and only the random part carries any strength, so seven characters drawn from a 24-character unambiguous alphabet give about 4.6 billion combinations.
These are code strings, not live discounts — no public page can create a discount that works at your checkout, because that needs a signed-in session for your specific shop. Paste them into Shopify Discounts to make them real. Combination counts are arithmetic; the strength bands and the 10 attempts a second behind the time estimate are our own assumptions, not a published standard.
A code has two halves that do completely different jobs. The prefix is for you, so a code is identifiable in a report. The random part is the only half a shopper could ever guess, and it is the only half the arithmetic below is about.
- The prefix
- A fixed label at the front — WELCOME, THANKS, the name of a creator. It exists so that when a code shows up in your orders report you know which campaign it came from. It contributes exactly nothing to how hard the code is to guess, because it is printed wherever the code is.
- The random part
- The characters after the prefix. This is the whole of the code security, and it is the only input that moves the numbers on this page.
- The alphabet
- Which characters can appear in the random part. The unambiguous set here holds 24 characters and deliberately drops the look-alikes: O, zero, I, one, L, S, five, B, eight, Z, two and V. Digits only holds ten, which is why a digits-only code needs to be much longer to reach the same strength.
- Alphabet size to the power of the length
- The number of codes that could exist with those settings. Each extra character multiplies the whole space by the alphabet size, which is why adding one character is worth far more than switching to a bigger alphabet.
- Guesses per hit
- The combination count divided by how many of your codes are live at once. This is the number that actually matters: a huge keyspace with thousands of valid codes in it is not as safe as it looks, because an attacker is not trying to find one specific code, only any valid one.
- The time estimate
- Guesses per hit divided by 10 attempts a second. That rate is an assumption we state rather than a measurement, and it is not a Shopify figure. It is here to turn a very large number into a length of time you can weigh, not to predict what any real attacker would do.
- The strength bands
- guessable, then adequate, then strong, over guesses per hit. Our own cut points. Nobody publishes a discount-code strength standard with a disclosed sample, so none is cited here and none is implied.
Nudgesmart is available on the Shopify App Store. Browse the template library or see what it costs.
Where a code ends up, and what that asks of it
Six places a discount code ends up, and what each one asks of the code. Every sample below is produced by the same function the generator above runs, with the same seed, so the table and the tool cannot print different codes for the same settings.
| Where the code goes | Sample | Set | Live codes | Combinations | Strength |
|---|---|---|---|---|---|
| One-per-visitor popup reward, small batch | WELCOME-KU4DE6R | 7 from 24 | 25 | 4.6 billion | Adequate1 hit per 183 million tries |
| Influencer codes, read aloud on camera | SUMMERGZILQ | 5 from 26 | 40 | 11.9 million | Guessable1 hit per 297 thousand tries |
| Printed insert in every parcel | THANKS-P99G76F | 7 from 24 | 200 | 4.6 billion | Adequate1 hit per 22.9 million tries |
| Emailed win-back, click-through only | COMEBACKF12CH79IO | 9 from 36 | 500 | 102 trillion | Strong1 hit per 203 billion tries |
| Phone-order code, digits only | CALL-330906 | 6 from 10 | 100 | 1 million | Guessable1 hit per 10 thousand tries |
| Short code shared on a public page | SALE4MEP | 4 from 24 | 300 | 332 thousand | Guessable1 hit per 1.1 thousand tries |
Three of the six come back guessable, and only one of them for the reason people expect. The phone-order row is digits only. The influencer row is five characters. The public-page row is four characters with three hundred live at once, which works out at one valid code in every 1.1 thousand guesses. The pattern holds every time: length first, how many codes are live second, alphabet a distant third.
What this number doesn't tell you
A generated string is not a discount
Until you create it in Shopify it is a word. The code has no value, no rules, no expiry and no usage limit, and a customer who tries it will be told it is invalid. This is the single most important thing on the page and it is why it is repeated next to the output rather than buried here.
The strength number says nothing about how the code leaks
Most discount codes are not guessed, they are shared. A one-per-customer code posted to a deal forum is compromised by a human, not by a brute-force attempt, and no amount of keyspace prevents that. Usage limits and customer-specific eligibility in Shopify are what handle it.
Uniqueness here is only within one batch
The tool guarantees no duplicates inside a batch it generates. It cannot know what codes already exist in your store, so if you run several batches with the same prefix and length, check for collisions before you import. Shopify will refuse a duplicate, which is a safe failure but an annoying one at scale.
The randomness is statistical, not cryptographic
The generator is seeded so that the page renders the same codes on the server and in your browser, which is what keeps the batch you see identical to the batch you download. That is the right trade for a discount code and the wrong one for anything guarding money or identity. Do not reuse these strings as passwords, API keys or gift-card numbers.
It has no opinion on the discount itself
How much to take off, who should get it and whether the offer makes money are all questions this page does not touch. It only decides what the code looks like.
Questions
Does this tool create real Shopify discount codes?
No, and no public page can. It generates code strings. Turning a string into a discount that works at checkout requires a signed-in session for one specific shop, which this page does not have. Copy the codes into Shopify Discounts, or let an app that is already installed on your store mint them.
Is this a coupon finder for shoppers?
No. It is a tool for merchants who run their own store and need to issue their own codes. It cannot produce a working code for a store you do not own, and a generated string will simply be rejected at any checkout it was not created in.
How many characters should a discount code have?
It depends on how many are live at once and where the code appears. Seven random characters from a 24-character alphabet gives about 4.6 billion combinations, which is comfortable for a few hundred live codes. Four characters gives about 332 thousand, which is guessable in minutes if hundreds of them are valid.
Why leave out letters like O, I and S?
Because they get misread. O against zero, I against one and against L, S against five, B against eight, Z against two. Every one of those turns into a message from a customer whose code will not work, which costs more to answer than the discount was worth. The unambiguous set drops all of them, and the tool shows you exactly what that costs in combinations.
Does the prefix make a code harder to guess?
Not at all. The prefix is printed on the insert, in the email and on the landing page, so anybody attacking your checkout already knows it. Only the random characters count. Any generator that folds the prefix into its strength claim is flattering you about the one number you came to check.
Can I export the codes in bulk?
Yes. Generate up to 500 unique codes in a batch and download them as a one-column CSV with a code header. The file is built in your browser and never reaches a server, so nothing about the batch is stored anywhere but your own download folder.
Does this tool need my store, an account or an install?
No. It runs entirely in the page, and nothing you type or generate is sent anywhere.
A code is a string until something enforces it.
Nudgesmart issues the code inside the popup that earns it, and reports what each campaign captured.
