Token Generator

Cryptographically secure tokens, API keys and secrets via the Web Crypto API

Options

Tune format, length and count

32
3

Tokens

Click copy on any token

Examples

Hex format for illustrative bytes

Input
Bytes: 00 FF 10 AB
Output
00ff10ab

Hex uses two lowercase characters per byte, so four bytes become eight characters. Actual bytes are random on every run.

Base64url format for illustrative bytes

Input
Bytes: 00 FF 10 AB
Output
AP8Qqw

URL-safe base64 replaces + and / when present and strips trailing = padding. Actual bytes are random on every run.

Alphanumeric format for illustrative bytes

Input
Bytes: 00 FF 10 AB
Output
AHQv

Each byte indexes the 62-character alphabet through modulo arithmetic, producing one character per byte. Actual bytes are random on every run.

About this tool

Token Generator creates batches of browser-generated random values using crypto.getRandomValues. Choose 8 to 64 random bytes, request 1 to 10 tokens, and render each byte array as hexadecimal, unpadded base64url, or an alphanumeric string.

The length control represents bytes, not output characters. Hex emits two characters per byte; base64url expands three bytes to roughly four characters and removes padding; alphanumeric maps each byte to one character. Changing the format, byte count, or batch count regenerates the entire set automatically.

Every token is generated locally and can be copied individually. Hex and base64url preserve all bits from the random byte array; the current alphanumeric formatter uses byte modulo 62, which introduces a small distribution bias and should not be treated as equivalent to uniform rejection-sampled alphanumeric generation.

How to use

  1. Choose an encoding

    Select Hex, Base64url, or Alphanumeric according to the character set accepted by the destination system.

  2. Set bytes of entropy

    Move the byte slider from 8 to 64. Remember that encoded output length differs by format.

  3. Choose the batch size

    Set How many from 1 to 10; changing any option immediately generates a fresh batch.

  4. Regenerate and copy

    Click Regenerate whenever you need new values, then copy the required token from its row.

Use cases

Create development API keys

Generate high-entropy base64url or hex values for local fixtures, test environments, and one-time setup scripts.

Seed session or reset-token fixtures

Produce batches with consistent byte lengths for testing storage limits and validation rules.

Generate URL-safe opaque identifiers

Use base64url when the value must travel in a path, query string, or cookie without standard base64 punctuation or padding.

Match a hexadecimal secret field

Generate lowercase hex when a configuration field or protocol expects a fixed number of random bytes encoded as pairs of hex digits.

Common mistakes

Mistake:Reading the byte slider as a character-count slider.

Fix:Calculate output length by format: hex is 2× bytes, alphanumeric is 1×, and unpadded base64url is approximately 4/3×.

Mistake:Reusing an example token as a real secret.

Fix:Examples are illustrative and public. Generate a fresh value and store it through your application's secret-management process.

Mistake:Assuming all three formats have identical character distributions.

Fix:Hex and base64url encode the random bytes directly. The alphanumeric mode uses modulo 62 and has a small bias; choose a rejection-sampled generator when strict uniformity is required.

Mistake:Generating a token and then changing an option before copying it.

Fix:Option changes regenerate the batch immediately. Copy the value first or avoid changing controls until it is stored.

Frequently asked questions

Related guides

UUID Versions Explained: v1 vs v4 (and Where v7 Fits)

What the version nibble in a UUID means, how v1 and v4 differ, why v7 is taking over for database keys, and how unlikely a collision really is — with generation tips and format options.

Generating Secure API Tokens and Secrets in the Browser

How to create cryptographically strong tokens, sign payloads with HMAC, and encrypt data with AES — all client-side, with nothing sent to a server.

References & standards

Related tools

AES Encryption

Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.

Basic Auth Generator

Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.

Bcrypt Generator & Verifier

Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.

BIP39 Mnemonic Generator

Generate and validate BIP39 seed phrases locally for testing

Checksum Calculator

Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API

CORS Header Validator

Validate Cross-Origin Resource Sharing headers for security compliance