Random alphanumeric string generator function (C, Windows, bcrypt.h) The function uses the Windows &quot;Cryptography API: Next Generation&quot; (bcrypt.h)'s BCryptGenRandom function to generate random bytes - one for each character.
It returns the number of characters (excluding NUL-terminator) written to the buffer, -1 in the case of a bad argument, or -2 in the case of an error.
Example usage of the function:
wchar_t str[9]; // 8 chars + NUL
rand_alphanum_str(str, sizeof (str));
printf(&quot;8 random alphanumeric characters: %wS\n&quot;, str);

Function code:
int rand_alphanum_str(WCHAR *buffer, size_t buffer_size) {
    if(!buffer || buffer_size &lt; 2) { return -1; }

    int chars = buffer_size / sizeof (WCHAR) - 1; // -1 for null terminator

    // need one random byte per character to be generated
    unsigned char *rand_bytes = malloc(chars);
    if(!rand_bytes) { return -2; }

    // filling rand_bytes buffer
    if(!NT_SUCCESS(BCryptGenRandom(NULL, rand_bytes, chars,
                                   BCRYPT_USE_SYSTEM_PREFERRED_RNG))) {
        free(rand_bytes);
        return -2;
    }

    for(int i = 0; i &lt; chars; ++i) {
        // rand_bytes[i] is in range [0, 255].
        // need a number in range [0, 61] - as there are 62 alphanumeric
        // characters

        // bit-twiddling to attempt to maintain a uniform distribution:

        // discard 2 least-significant bits - rand_bytes is now in [0, 63]
        rand_bytes[i] &gt;&gt;= 2;
        if((rand_bytes[i] &gt;&gt; 5) &amp; 1U) {   // if the now most-significant bit is set,
            rand_bytes[i] &amp;= ~(1UL &lt;&lt; 1); // clear the 2nd least-significant bit
            // (only cleared if most-significant bit is set so as to avoid
            // throwing distribution off by having a bit which is never set)
        }
        // rand_bytes[i] is now in [0, 61]

        // of the 62 possible values of rand_bytes[i]:
        //   - [0, 9] represent numeric digits
        //   - [10, 35] represent uppercase letters
        //   - [36, 61] represent lowercase letters
        // the offset of rand_bytes[i] from the low end of the range it lies in
        // is added to said range's first ASCII value to give a random character
        // in that range
        if(rand_bytes[i] &lt;= 9) {
            buffer[i] = L'0' + rand_bytes[i];
        } else if(rand_bytes[i] &lt;= 35) {
            // -10 for offset from beginning of numeral range
            buffer[i] = L'A' + rand_bytes[i] - 10;
        } else {
            // -36 for offset from beginning of uppercase range
            buffer[i] = L'a' + rand_bytes[i] - 36;
        }
    }
    buffer[chars] = L'\0';

    free(rand_bytes);
    return chars;
}


Thank you!
The output is not uniformly distributed
The resulting characters in the output string are not uniformly distributed. In fact, some characters never occur in the output. After shifting a random byte right by two, if the result is larger than or equal to 32, you always clear the second least significant bit. So all values up to 32 are possible, but then it is 32, 33, 36, 37, 40, 41 and so on. And each value &gt;= 32 that your algorithm generates is twice as likely as each value &lt; 32.
The best solution is to first shift the random byte right by two, and then check i it is smaller than 62. If so, use it as it is. Otherwise, generate a new random byte and repeat the process.
Avoid allocating an array of random bytes
You are allocating an array to store the random bytes in. While it might seem efficient to do this, because you assumed you then only need one call to BCryptGenRandom(), this might be an issue if you want to generate large random strings. Also, if you want to have a proper uniformly distributed output, you might need to generate more random bytes than you originally anticipated.
Consider having a small array on the stack that you fill with random bytes, and use those to generate the alphanumeric characters. If you used up all the bytes, you fill the array with a new batch of random bytes.