Token Generator

Generate cryptographically secure random tokens in hex or base64 format

Cryptographic Token Generator — Create Secure Random Tokens for API Keys, Session IDs, CSRF Protection, and Authentication Using Web Crypto API

  1. Select the cryptographic bit length for your token: 128 bits (16 bytes, 32 hex chars) — suitable for session IDs, database record identifiers, and CSRF tokens where the threat model assumes limited brute-force attempts; 256 bits (32 bytes, 64 hex chars) — the recommended default for API keys, authentication tokens, and secret keys, providing 2^256 possible values (a number exceeding the estimated atoms in the observable universe); 512 bits (64 bytes, 128 hex chars) — for HMAC signing keys and high-security applications where the additional entropy cost is negligible. Each doubling of bit length squares the search space — 256-bit keys aren't just twice as strong as 128-bit; they're 2^128 times stronger.
  2. Choose your output format: Hex (hexadecimal) produces a string using characters 0–9 and a–f — the most portable format, safe in all contexts (URLs, JSON, databases, configuration files) and easy to visually verify length (each byte = 2 hex characters). Base64 URL-safe produces a more compact string using A–Z, a–z, 0–9, - and _ — about 25% shorter than hex for the same bit length, and safe for use in URLs without percent-encoding. The Base64 variant uses the URL-safe alphabet (RFC 4648 §5) that replaces + with - and / with _, and omits padding = characters — ideal for tokens that appear in query strings or HTTP headers.
  3. Click Generate to create a cryptographically secure random token using the browser's crypto.getRandomValues() Web API — the same entropy source used by SSL/TLS for generating session keys. Each click produces a fresh, independent random value with no relationship to any previous token. Click Copy to transfer the token to your clipboard. Use generated tokens for: API key provisioning, JWT secret keys (256+ bits recommended), password reset tokens (time-limited, single-use), OAuth state parameters (prevent CSRF in OAuth flows), session identifiers, HMAC signing keys, and any application requiring unpredictable, unguessable values. All generation happens entirely in your browser — tokens are generated locally and never transmitted to any server.

Enable JavaScript to use these tools.