Secure Token Generator
Create cryptographically random tokens for API keys, session IDs, CSRF protection and password-reset links, directly in your browser with the Web Crypto API. Choose random, hexadecimal, URL-safe, numeric or UUID formats, generate up to 20 at a time and export them as JSON or CSV.
100% client-side · Web Crypto API · Your tokens are never stored or sent
Strength
Store tokens in a secret manager, never in source control, and revoke any token that may have been exposed.
How Secure Tokens Work
A secure token is just a long random number written in a convenient alphabet. Its strength is the number of random bits it carries: an attacker has to try about half of all possible values on average, so every extra bit doubles the work. This page draws each character with the Web Crypto API and rejection sampling, so every character is equally likely, and it reports the exact entropy of the tokens it can produce.
Characters are not the right unit for comparing formats, because they carry different amounts of randomness: 4 bits for a hex digit, about 5.95 bits for a letter or digit, 6 bits for a URL-safe character and 3.3 bits for a decimal digit. That is why the page shows the entropy in bits and rates strength against the common 128-bit guideline.
Cryptographic Randomness
Every character comes from the Web Crypto API, with no modulo bias, so each is equally likely
Modern Formats
Hex, Base64url (RFC 4648), numeric, random characters, and UUID v4 or v7 (RFC 9562)
Exact Entropy
Measured in bits, including the at-least-one-of-every-type rule, with bands based on the 128-bit guideline
Prefixes for API Keys
Add a prefix such as sk_live_ to make keys easy to recognise, rotate and scan for
Safe Bulk Export
Up to 20 tokens at once, as JSON or as CSV that spreadsheets cannot run as formulas
Nothing Stored
Generated in your browser with no network requests, no history and no external scripts
Explore more free tools in our security tools collection, including our strong random password generator.
Frequently Asked Questions
1. What is a security token?
A security token is a random string used as a secret or an identifier: an API key, a session ID, a CSRF token, a password-reset link or a webhook secret. Its security comes entirely from being impossible to guess, which depends on how many random bits it contains and on whether those bits come from a cryptographically secure random generator.
2. How secure is this generator?
Every token is built from values returned by crypto.getRandomValues, the browser’s cryptographically secure random generator. Choices are made by rejection sampling, which means no character is more likely than another. Tokens are created in your browser, the page’s content security policy blocks outgoing network requests, and nothing is saved.
3. Which token type should I choose?
Hexadecimal gives 4 bits per character and is the most compatible. URL-safe uses the Base64url alphabet (letters, digits, hyphen and underscore) for 6 bits per character and is safe in URLs, headers and file names. Random characters lets you choose letters, digits and symbols. Numeric is only for short one-time codes. UUID v4 has 122 random bits and is an identifier. UUID v7 (RFC 9562) starts with the creation time and has only 74 random bits, so use it for sortable identifiers, never as a secret.
4. How long should a token be?
Think in bits rather than characters. Many guidelines ask for at least 128 bits for long-lived secrets such as API keys and session IDs. That is 32 hex characters, 22 URL-safe characters, 22 letters and digits, or 39 digits. For very high-value secrets use 256 bits. The meter bands follow this: under 64 bits is Weak, 64 to 95 is Fair, 96 to 127 is Good, 128 to 255 is Strong and 256 or more is Very strong.
5. What does the prefix do?
A prefix such as sk_live_ is added in front of every token. Many services do this so that a leaked key is easy to recognise, to rotate and to find with secret-scanning tools. The prefix is public, so it is not counted in the entropy.
6. Can I use these tokens as passwords?
Yes, a random token makes a strong password for an account you manage with a password manager. For passwords you must remember or type, use our strong random password generator instead.
7. Is exporting safe?
Exports are made in your browser and saved to your device. The files contain real secrets, so keep them private, never commit them to source control and delete them when you no longer need them. In CSV files, a token that starts with =, +, - or @ gets a leading apostrophe, because spreadsheets would otherwise run it as a formula. The JSON file keeps every token exactly as generated.
8. Is my token stored or sent anywhere?
No. There is no history and nothing is saved except your language choice. Earlier versions of this page loaded a script from an outside server and displayed several tokens as HTML, which could garble tokens containing characters such as < or &. This version loads no outside scripts and shows tokens as plain text.