Security

Random Token Generator

Mint API keys, session secrets, and CSRF tokens with real cryptographic randomness.

Tokens are generated locally with crypto.getRandomValues. Nothing is uploaded, logged, or stored.

How to use

  1. Choose the entropy size (16–64 bytes) and the output format.
  2. Set how many tokens to generate, then click Generate.
  3. Copy a token straight into your environment variables or secret store.

Which format should I pick?

Hex is the safest choice — universally accepted and easy to validate. base64url packs the same entropy into roughly 25% fewer characters and is safe in URLs and headers. Plain base64 contains + and /, which can clash in URLs. As a rule of thumb: 32 bytes (256 bits) is plenty for API keys and session tokens.

Human-type passwords instead? Use the Password Generator. To sign tokens rather than just hold them, see the JWT Decoder and HMAC Generator.

Examples

API keys and webhooks

Create a fresh bearer token per integration and rotate them without touching code.

CSRF and session secrets

Generate unpredictable values for CSRF cookies, password-reset links, and invite codes.

Frequently Asked Questions

Are tokens sent to a server?+
No. Generation happens entirely in your browser — tokens exist nowhere else unless you save them.
How much entropy do I need?+
128 bits (16 bytes) is the practical minimum; 256 bits (32 bytes) is the common choice for long-lived secrets.
Is base64url different from base64?+
Yes — base64url swaps +/ for -_ and drops padding, making tokens safe inside URLs without escaping.
Can I regenerate later and get the same token?+
No — every click produces fresh randomness. Store tokens immediately in your secret manager.

Related Tools

SecuritySecurity Analyzer

JWT Decoder & Security Analyzer

Decode JWT header and payload locally, then run security checks: weak algorithms, expiry, risky claims.

Security

Password Generator

Generate strong random passwords with crypto.getRandomValues — pick length and character sets.

Security

htpasswd Generator

Generate Apache/Nginx .htpasswd entries with bcrypt or {SHA} schemes — fully client-side.

Security

Bcrypt Generator & Verifier

Generate bcrypt password hashes with adjustable cost and verify hashes against passwords.

Looking for something else? Browse all tools