About the Random Token Generator
Generate random tokens suitable for API keys, session secrets, or one-time identifiers. Choose the raw byte length and an output encoding, add an optional prefix, and produce several tokens at once for bulk provisioning.
How to use it
- 01Set the byte length (8 to 128 bytes of underlying entropy).
- 02Pick an output format: hex, base64, base64url, or alphanumeric.
- 03Optionally add a prefix such as 'sk_' or 'tok_'.
- 04Choose how many tokens to generate (up to 20).
- 05Generate, then copy or download the list as a .txt file.
Features
- Cryptographically secure bytes from crypto.getRandomValues, never Math.random.
- Four output encodings covering common developer needs.
- Optional prefix for namespacing tokens.
- Bulk generation up to 20 tokens per run.
- Download all generated tokens as a plain text file.
Practical examples
API secret key
Use 32 bytes with base64url encoding and a 'sk_' prefix to produce a URL-safe secret suitable for API authentication.
Session identifiers
Generate 16-byte hex tokens in bulk for use as short-lived session identifiers in a test environment.
Limitations
- Byte length, not final string length, is configured; different encodings expand bytes to different output lengths.
- This tool does not manage token storage, rotation, or revocation — that is the responsibility of your application.
Privacy
Tokens are generated entirely client-side using the Web Crypto API and are never transmitted to any server or saved to persistent storage.
Read the full privacy policy for how the site as a whole handles data.
Frequently asked questions
Which format should I use for a URL query parameter?
Base64url avoids characters that need percent-encoding in URLs, unlike standard base64.
How much entropy do I need?
16 bytes (128 bits) is generally sufficient for most secrets; use 32 bytes for long-lived, high-value credentials.
Can I regenerate the same token later?
No, each generation is independent and random; there is no seed or deterministic mode.