Random Token Generator
Generate cryptographically secure tokens for API keys, session IDs, password-reset links, and CSRF protection. Randomness comes from the browser crypto API, so tokens are suitable for security-sensitive use.
Tokens suit APIs and sessions; the UUID Generator covers identifiers and the Password Generator covers human logins. To sign with a token, use the HMAC Generator.
How to use the Token Generator
- 1 Choose how many bytes of randomness you need — 16 is a common minimum, 32 is comfortable.
- 2 Pick the output format: hex, Base64 or URL-safe Base64.
- 3 Generate and copy the token.
- 4 Store it as you would a password, and never log it.
How to Use
Choose a length and format, pick how many tokens you need, and generate. Copy individual tokens or the whole list.
- Uses the cryptographically secure random number generator
- Hex, Base64, URL-safe, alphanumeric, and UUID formats
- Generate up to 100 tokens at once
- Entropy estimate for the chosen length and format
- No network requests — generation is local
Frequently asked questions
How much randomness do I actually need?
128 bits is the usual floor for a session token or API key, which is 16 bytes. 256 bits gives a comfortable margin against any foreseeable attack. Shorter tokens are only acceptable when they are rate-limited and expire quickly.
Is this better than a UUID?
For a secret, yes. A UUID v4 carries 122 random bits and its structure is widely recognised, which invites assumptions about how it was generated. A raw random token of the same length has no structure to exploit and no implied meaning.
Where does the randomness come from?
The browser cryptographic random source, which is seeded by the operating system from hardware entropy. That is the same source used for TLS keys, and it is not predictable from previous output — unlike a seeded pseudo-random generator.
Related Security & Cryptography Tools
You might also need
Tools from other categories that people pair with the Token Generator: