Are the strings actually random and secure?

Yes. They come from the browser's cryptographically secure generator, crypto.getRandomValues, which is suitable for passwords, tokens and keys — unlike Math.random, which is not. The generation happens locally and nothing is transmitted or logged.

What does "exclude look-alikes" do?

It removes easily confused characters — capital O and zero, capital I, lowercase l, the digit 1 and the pipe — from the pool. This is helpful for strings a person might read aloud or type by hand, at the cost of a slightly smaller character set.

How long should a random string be?

For secrets, longer is stronger: with a mixed 70-plus character pool, 16 characters is a reasonable minimum and 24 to 32 is comfortable for API keys and tokens. Each extra character multiplies the number of possible combinations, so length matters more than any single character set.

What is the Random String Generator?

Free random string generator. Create cryptographically secure random strings from chosen character sets — uppercase, lowercase, digits and symbols — with adjustable length, batch counts and look-alike exclusion. Uses the browser CSPRNG; nothing is uploaded. It runs free in your browser on Gera Tools, with nothing uploaded.

Random String Generator

Name: Random String Generator
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

Whenever you need something unguessable — a password, an API key, a token, a nonce or a batch of unique test values — the random string generator produces it from the browser’s cryptographically secure random source. Choose the character sets, the length and how many you want, and copy the results with one click.

Secure by construction

The strings are drawn from crypto.getRandomValues, the browser’s cryptographically secure pseudo-random number generator. That distinction matters: the ordinary Math.random is fast but predictable and must never be used for secrets, whereas the CSPRNG used here is designed to resist prediction. All generation happens on your device — nothing is sent to a server or stored.

Choosing character sets and length

Mixing uppercase, lowercase, digits and symbols enlarges the pool of possible characters, and a larger pool means more combinations per character. But length is the biggest lever: every extra character multiplies the total number of possibilities. For secrets, 16 characters is a sensible floor and 24 to 32 is comfortable for keys and tokens. The look-alike exclusion option trades a little of that pool for strings that are easier to read and type by hand.

Batches and test data

Set the quantity above one to generate a whole batch at once — handy for seeding unique identifiers, coupon codes or fixtures in tests. Copy them individually or grab the entire list in a single click.