Token generator
Generate secure random tokens for API keys, identifiers and secrets. Choose a format and length; randomness is bias-free and entirely local.
Token
Options
Generate up to 100 tokens at once.
Charset: 16 characters
A secure random token generator
This tool generates random tokens for developers and systems: hexadecimal, Base62, Base64url, alphanumeric, numeric, UUID v4, NanoID and ULID. Every token is produced from a cryptographically secure random source with no modulo bias, entirely in your browser, so nothing you generate touches a server.
What is a secure token?
A token is a random string used as an identifier or secret — an API key, a session identifier, a password-reset link, a CSRF value, a unique record ID. “Secure” means it is unpredictable: generated from a cryptographically secure random number generator with enough length that an attacker cannot guess or enumerate it.
Common use cases for random tokens
Typical uses include API keys and client secrets, opaque session identifiers, single-use password-reset and email-verification tokens, webhook signing secrets, idempotency keys, and sortable identifiers such as ULIDs for database rows. Different jobs suit different formats — UUID v4 for globally unique IDs, Base64url for compact URL-safe secrets, hex for fixed-width keys.
Token length and entropy
A token’s strength is its entropy: the number of random bits it carries. For secrets that must resist guessing — API keys, reset tokens — aim for at least 128 bits of entropy. The number of characters needed depends on the alphabet: hexadecimal carries 4 bits per character, Base62 about 5.95, Base64url 6. The generator shows the entropy for your chosen format and length so you can hit a target with confidence.
API keys, reset tokens, and developer secrets
For anything that grants access, prefer at least 128 bits of entropy, store only a hash of the token on the server, and give security-sensitive tokens (password resets, magic links) a short expiry and single use. URL-safe formats like Base64url or Base62 avoid percent-encoding when a token appears in a link.
Why tokens should be generated locally
Generating a secret on a third-party server means trusting that server not to log or retain it. Because this tool runs entirely in your browser with the Web Crypto API, the secret never leaves your machine. For production systems, generate tokens server-side with your platform’s CSPRNG; for quick keys, manual rotations and examples, local generation here keeps the value private.
Frequently asked questions
Are these tokens cryptographically secure?
Yes. They are produced with the Web Crypto API’s CSPRNG using rejection sampling to avoid modulo bias, so every value in the alphabet is equally likely.
How long should an API key or token be?
Aim for at least 128 bits of entropy. In hex that is 32 characters; in Base62 about 22; in Base64url about 22. The tool displays the entropy for your settings.
What is the difference between UUID v4, NanoID and ULID?
UUID v4 is a 122-bit random identifier in a standard format. NanoID is a compact URL-safe random ID. ULID is a 128-bit identifier that sorts by creation time, which is handy as a database key.
Are the tokens sent to a server?
No. Generation happens entirely in your browser; nothing is transmitted, logged or stored.
Which format should I use in URLs?
Use a URL-safe format such as Base64url or Base62 so the token needs no percent-encoding when placed in a link.
Should I store the raw token in my database?
For access-granting tokens, store only a hash (and compare hashes), so a database leak does not expose usable secrets. Give reset and verification tokens a short expiry and single use.