Random Token Generator
Generate API tokens, session keys and CSRF tokens.
Makes leaked keys identifiable to secret scanners.
What does Random Token Generator do?
Produce cryptographically secure random tokens in the encodings backend systems expect — hexadecimal, Base64, Base64URL or alphanumeric — at a byte length you choose, with the entropy shown so you can justify the size.
How to Use Random Token Generator
- 1Choose the byte length32 bytes (256 bits) suits most purposes.
- 2Pick the encodingBase64URL if it will appear in a URL.
- 3Add a prefixOptional, but it makes leaked keys easy to identify.
- 4Copy the tokenStore it securely straight away.
Key Features
- Hex, Base64, Base64URL and alphanumeric encodings
- Byte length from 8 to 128, with entropy shown in bits
- Optional prefix such as sk_live_ for structured API keys
- Generate several tokens at once
- Presets matching common conventions for session, CSRF and API tokens
Frequently Asked Questions
How long should an API token be?
32 random bytes — 256 bits — is the standard recommendation and is far beyond brute force. 16 bytes (128 bits) is acceptable for short-lived session tokens. Anything under 16 bytes is cutting it fine.
Which encoding should I use?
Base64URL for anything appearing in a URL or header, since it needs no escaping. Hex when you want an unambiguous, case-insensitive value that is easy to read aloud. Hex is twice as long as Base64 for the same entropy.
Why add a prefix to a token?
It makes leaked credentials identifiable. Secret-scanning tools on code hosts recognise prefixed patterns and can alert you automatically, which is why major APIs use them.
Should I store tokens in plain text?
No. Store a hash of the token, exactly as you would a password, and compare hashes on lookup. That way a database leak does not hand over working credentials.
This tool works with your network connection switched off. Values are produced by the browser Web Crypto API and never leave your device — no request is made, nothing is logged.
Related Tools
Secret Key Generator
Generate signing keys and encryption secrets of the right length.
Password Generator
Create strong random passwords and memorable passphrases.
UUID Generator
Generate v4 and v7 UUIDs in bulk, cryptographically random.
Random String Generator
Generate random strings, IDs and codes in bulk.