Token Generator
Generate a cryptographically secure random token in hex, Base64, URL-safe Base64, or alphanumeric format - for API keys, session tokens, and secrets.
Recommended Settings
Pro Tips
- •This uses the Web Crypto API's cryptographically secure random source, the same standard used for generating real security tokens
- •URL-safe Base64 replaces + and / with - and _ and strips padding, making it safe to use directly inside a URL
- •32 bytes (256 bits) is a common, strong default length for most session tokens and API keys
- •Never reuse a generated token across multiple systems, and always transmit tokens over HTTPS
Most Popular
Most developers generate a 32-byte hex or Base64 token for API keys and session secrets
When to Use This Tool
Generate a secure random value to use as an API key or application secret.
Create a random token for identifying and securing user sessions.
Generate a random token to protect forms against cross-site request forgery.
Generate a random code for password resets, email verification, or invite links.
How It Works
Generate the requested number of cryptographically random bytes using the Web Crypto API
Encode those bytes into your selected format - hex, Base64, URL-safe Base64, or a plain alphanumeric string
Display the result, ready to copy
100% Private
Files never leave your device. All processing happens locally in your browser.
Lightning Fast
Powered by Web Crypto API (crypto.getRandomValues) for optimal performance on modern browsers.
Open Source
Built with verified, open-source libraries. Fully transparent.
Frequently Asked Questions
Is this cryptographically secure?
Yes, it uses the Web Crypto API's crypto.getRandomValues, a cryptographically secure random number source suitable for generating real tokens and secrets.
Which format should I use?
Hex and Base64 are the most common formats for API keys and tokens. Use URL-safe Base64 specifically if the token will appear directly in a URL path or query string.
How long should my token be?
32 bytes (256 bits) is a strong, commonly used default. Shorter tokens may be appropriate for less sensitive, short-lived use cases.
Is my data sent to a server?
No. Every token is generated entirely in your browser.
Should I store this token in my code?
No, secrets and tokens should be stored in environment variables or a secrets manager, never committed directly into source code.