Skip to content
ToolzKit

Security

Random Token Generator

Generate cryptographically random tokens as hex, base64, base64url or alphanumeric strings.

Tokens

Generated tokens appear here.

Tokens are generated locally using the Web Crypto API and never leave your browser.

About the Random Token Generator

Generate random tokens suitable for API keys, session secrets, or one-time identifiers. Choose the raw byte length and an output encoding, add an optional prefix, and produce several tokens at once for bulk provisioning.

How to use it

  1. 01Set the byte length (8 to 128 bytes of underlying entropy).
  2. 02Pick an output format: hex, base64, base64url, or alphanumeric.
  3. 03Optionally add a prefix such as 'sk_' or 'tok_'.
  4. 04Choose how many tokens to generate (up to 20).
  5. 05Generate, then copy or download the list as a .txt file.

Features

  • Cryptographically secure bytes from crypto.getRandomValues, never Math.random.
  • Four output encodings covering common developer needs.
  • Optional prefix for namespacing tokens.
  • Bulk generation up to 20 tokens per run.
  • Download all generated tokens as a plain text file.

Practical examples

API secret key

Use 32 bytes with base64url encoding and a 'sk_' prefix to produce a URL-safe secret suitable for API authentication.

Session identifiers

Generate 16-byte hex tokens in bulk for use as short-lived session identifiers in a test environment.

Limitations

  • Byte length, not final string length, is configured; different encodings expand bytes to different output lengths.
  • This tool does not manage token storage, rotation, or revocation — that is the responsibility of your application.

Privacy

Tokens are generated entirely client-side using the Web Crypto API and are never transmitted to any server or saved to persistent storage.

Read the full privacy policy for how the site as a whole handles data.

Frequently asked questions

Which format should I use for a URL query parameter?

Base64url avoids characters that need percent-encoding in URLs, unlike standard base64.

How much entropy do I need?

16 bytes (128 bits) is generally sufficient for most secrets; use 32 bytes for long-lived, high-value credentials.

Can I regenerate the same token later?

No, each generation is independent and random; there is no seed or deterministic mode.