Random Token Generator
Create cryptographically secure random tokens for sessions, password resets, CSRF and invites. Hex, Base64url, Base32 or alphanumeric; 256 bits by default.
Optional, e.g. sk_live_ or myapp_. It makes keys recognizable and easier to detect in leaked code.
256 bits of entropy · 64 characters per value
Generated locally with crypto.getRandomValues; nothing is sent or stored. Keep secrets in environment variables or a secret manager, never in source code.
What is Random Token Generator?
Generate unguessable random tokens for password-reset links, email verification, invitation codes, CSRF protection, session IDs or any one-time secret. The default is 32 random bytes (256 bits) shown as 64 hex characters; you can switch to URL-safe Base64url, Base32, Base64 or alphanumeric output.
How to use Random Token Generator
- Pick the Format: hex is the most common, Base64url is shorter and safe in URLs.
- Set the number of Random bytes (or Length in characters for alphanumeric formats).
- Choose How many tokens to generate and click Regenerate for a new set.
- Copy the tokens.
Example
Format Base64url, 32 random bytes, How many 1
81u4aRrBPjZmdbKks_Gh_FDt4AKsSY4FQllDH0mkThk
256 bits, 43 characters. Random — yours will differ.
When to use Random Token Generator
Use these tokens wherever possession of the value grants access and it must not be guessable. For values that need structure or expiry inside them (claims, signatures) use JWTs instead; for database IDs that do not need to be secret, UUIDs are simpler.
How Random Token Generator works
The tool requests N random bytes from the browser's CSPRNG (crypto.getRandomValues) and encodes them: hex uses two characters per byte, Base64url (RFC 4648 §5) uses A-Z a-z 0-9 - _ without padding, Base32 uses A-Z 2-7. The entropy line shows bits of randomness (8 × bytes) and the resulting length, and warns below 128 bits.
Common Use Cases
- Password-reset and email-verification links
- Session identifiers and CSRF tokens
- Invitation or one-time download codes
- Webhook secrets and shared signing keys
Security Note
Treat tokens like passwords: give them an expiry, invalidate them after use, and store only a hash on the server when possible.
FAQs
Hex or Base64url?
Both carry the same randomness for the same number of bytes. Base64url is about a third shorter (43 vs 64 characters for 32 bytes) and safe in URLs; hex is easier to read and compare.
How many bytes do I need?
16 bytes (128 bits) is the usual minimum for security tokens; 32 bytes (256 bits) leaves a comfortable margin.
Is it safe to generate tokens in the browser?
Yes. crypto.getRandomValues is a cryptographically secure generator, and nothing is sent to a server. For tokens your application issues to users, generate them on your server with the same kind of CSPRNG.