Token Generator
Generate secure random API keys and bearer tokens in hex, Base64, Base64URL, or alphanumeric form using your browser's crypto RNG.
A token is a high-entropy random string used to authenticate a request or identify a session. Unlike a password, a person never types it—it is issued once, stored by a client, and presented on every call. Its strength therefore comes entirely from how many random bits it contains, not from being memorable.
This tool draws every byte from crypto.getRandomValues, the browser's interface to the operating system CSPRNG. The output is never transmitted, logged, or stored on a server, so a token generated here is as private as one generated on your own machine.
Format is a transport concern, not a security one: 32 random bytes carry 256 bits of entropy whether they are encoded as 64 hex characters, 44 Base64 characters, or 43 URL-safe characters. Choose the form your API expects; all four are equally unguessable for the same byte count.
Common uses
- Creating an API key or personal access token for a new service integration instead of inventing one by hand.
- Generating session secrets, CSRF tokens, or password-reset nonces that must be unpredictable to an attacker.
- Producing test fixtures and seed values when developing authentication flows locally.
Frequently asked questions
- How many bytes should a token be?
- At least 16 bytes (128 bits) for most purposes; 32 bytes (256 bits) is a safe default for long-lived API keys. More bytes never hurt security but produce longer strings, so balance against storage and header limits.
- Which format should I use?
- Use Base64URL when the token goes in a URL or Authorization header without extra encoding; hex when you need case-insensitive, shell-friendly values; plain alphanumeric when a system disallows punctuation. Entropy is identical at the same byte length.
- Is it safe to generate a token in a browser?
- Yes, when it uses the Web Crypto API as this tool does. crypto.getRandomValues is backed by the operating system CSPRNG and is the same source server-side languages use. The value never leaves your tab, so there is no network exposure.
- Can I use a token as a password?
- Not directly. A random token is strong but impossible to memorize, and most login systems apply password hashing and rate limiting designed for human-chosen secrets. Use the Password Generator for credentials you type, and this tool for machine-to-machine secrets.
- Why not use Math.random?
- Math.random is not cryptographically secure: its output can be predicted from enough observed values, which makes any token derived from it guessable. Always use crypto.getRandomValues for secrets, even in throwaway scripts.