Contact

Tools  /  Security  /  Random Token Generator

SECURITY

Random Token Generator

Cryptographically random tokens -- hex, Base64/Base64url, or alphanumeric, sized in real bits of entropy, bulk generation, .env export.

More Security tools

Hash Generator Password Generator JWT Decoder & Generator HMAC Generator Hash Identifier UUID Validator

What this tool does

Generates cryptographically random tokens -- suitable for API keys, session IDs, CSRF tokens, password-reset tokens, and any other secret that needs to be unguessable -- in hex, Base64, Base64url (URL- and filename-safe), alphanumeric (letters and digits only), or a custom alphabet you define yourself. The size control is in real bits of entropy, not just character count, since different output formats need different numbers of characters to carry the same amount of randomness.

How many bits do you actually need?

As a practical floor: 128 bits is the generally accepted minimum for anything that must resist guessing or brute force -- session IDs, CSRF tokens, password-reset links. 256 bits is the common recommendation for longer-lived secrets like API keys and signing secrets, where the cost of a compromise is higher and the token is worth extra margin. Below 128 bits, a token starts becoming a realistic brute-force target as hardware improves; there's rarely a good reason to go lower for anything security-sensitive.

Choosing a format

Hex is the safest universal choice -- every character is unambiguous in a URL, a shell command, a JSON string, or a database column, at the cost of needing twice as many characters as raw bytes. Base64url packs the same entropy into roughly a third fewer characters and is safe to use directly in a URL path or query string (unlike standard Base64, which can include +, / and padding = that need escaping in a URL). Alphanumeric avoids every special character entirely. A custom alphabet is for when a system has its own exact constraints -- digits only for a numeric code, a specific symbol subset, anything you can type.

Prefix, grouping, and excluding look-alikes

A prefix (like the sk_live_ or ghp_ style many real API keys use) is prepended to the random part and isn't counted toward entropy -- it's a label, not a secret. Grouping inserts a separator every N characters for readability, license-key style (XXXX-XXXX-XXXX), without changing the underlying randomness. Exclude look-alikes drops characters that are easy to misread or mistype when a human has to transcribe a token by hand (I, l, 1, O, 0) -- the same look-alike set the Password Generator tool uses.

Why rejection sampling, not a simple modulo

The alphanumeric, alphanumeric+symbols and custom-alphabet modes don't map each random byte onto the alphabet with a plain modulo (byte % alphabet.length) -- that introduces a small but real bias toward the low end of the alphabet whenever 256 isn't a multiple of the alphabet size. This tool uses rejection sampling instead: random bytes that would introduce that bias are discarded and redrawn, so every character in the output is uniformly distributed with no statistical skew. A custom alphabet is also automatically deduplicated before use -- a repeated character in what you typed would otherwise silently double that character's odds of appearing.

Export formats, QR, bulk, and history

Beyond copying the raw token, export it as a .env line, a shell export statement, a curl Bearer header, or a JSON object -- each with a configurable variable name. A QR code moves the current token to another device without typing it. Bulk generation produces up to 100 tokens at once, downloadable as a single text file. The history panel keeps the last 8 tokens generated this session, for getting back to one without regenerating it.

Privacy

Every token is generated with crypto.getRandomValues() -- a cryptographically secure random source -- entirely in your browser. The session history lives only in this tab's memory; it's never written to localStorage or sent anywhere. Nothing is sent to a server, and nothing is stored once you navigate away.

FAQ

Frequently asked questions

Is this actually cryptographically random?
Yes -- every token comes from crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator, not Math.random() (which is not safe for anything security-related).
How many bits of entropy should my token have?
128 bits is the practical floor for anything that needs to resist guessing -- session IDs, CSRF tokens, reset links. 256 bits is the common choice for longer-lived secrets like API keys, where the extra margin is worth the slightly longer string.
Which format should I use?
Hex if you want the safest, most universally compatible option. Base64url if you need it in a URL and want fewer characters for the same entropy. Alphanumeric if the destination can't handle symbols at all. A custom alphabet if a system has its own exact character constraints.
What does the prefix field do, and is it counted as entropy?
It's prepended to the random part as a label -- like the sk_live_ or ghp_ style real API keys often use -- and is never counted toward the bits-of-entropy figure, since a prefix is predictable by definition, not secret.
Is my generated token uploaded or stored anywhere?
No. Generation happens entirely in your browser. The session history is kept only in this tab's memory -- it's never written to localStorage or sent anywhere, and it's gone as soon as you reload or close the page.
Why not just map random bytes onto letters and digits with a modulo?
A plain modulo (byte % 62 for an alphanumeric alphabet, for instance) is very slightly biased toward lower values whenever the alphabet size doesn't evenly divide 256. This tool uses rejection sampling instead -- discarding and redrawing any byte that would introduce that bias -- so every character is genuinely uniform. A custom alphabet is also deduplicated first, so a repeated character you typed can't silently skew the odds.
Can I generate several tokens at once?
Yes -- set the bulk count (up to 100) and generate a full batch in one click, each individually copyable or downloadable together as a text file.
What does "exclude look-alikes" do?
It drops characters that are easy to misread or mistype when a human has to transcribe a token by hand -- I, l, 1, O and 0 -- the same look-alike set used in the Password Generator tool, available for the alphanumeric and custom-alphabet formats.
Theme Accent