Random token generator
This random token generator creates unpredictable strings for API keys, password reset links, CSRF tokens and other secrets. Developers use it when they need a quick, strong value without writing code.
- Runs in your browser
- Free, no account needed
- Copy or download the result
Result
Example
Random bytes per token: 32 Format: Hex (0-9, a-f) How many tokens: 5
5 tokens, hex, 32 random bytes (256 bits), 64 characters: 03d059cce63560b84b13334066e31ebf3b06e1e25d16394554b710bcc7363c28 0f754b5ead7c26d40d197257c8c4ee7521c36c993d2dedc63a7d43aa616da9e8 9cd7168f7b774fa19c90abfa9115fe1709fbfc84c5a72c1acb55a330eae5627b 1a1aeecf13a4efcdf7f8ac997048e664a5f1ca626776c683479a24e480f098b4 eccbae16e3a5bb95a3835222648ed089493855dcf701a88e0e6d095c62b21eb2 Made with crypto.getRandomValues in your browser. Nothing is sent or stored.
How to use the random token generator
- Set Random bytes per token, from 8 to 128.
- Pick a Format: Hex, Base64, Base64url or Alphanumeric.
- Set How many tokens, from 1 to 100, then press Run.
- Use Copy result or Download to save the tokens.
How it works
Bytes come from crypto.getRandomValues, the browser's cryptographically secure random source.
Hex uses 2 characters per byte, Base64 keeps = padding, and Base64url uses - and _ instead of + and / with no padding, so tokens fit in URLs.
Alphanumeric tokens use enough characters to carry at least as many bits as the chosen bytes, such as 43 characters for 32 bytes, and use rejection sampling so each of the 62 characters is equally likely.
Tokens are made in your browser and are not sent or stored.
Everything runs in your browser. Your input is not uploaded or stored.
Questions and answers
How many bytes should a token have?
16 bytes (128 bits) is a common minimum for secrets and session IDs, and 32 bytes (256 bits) gives a wide margin.
What is the difference between Base64 and Base64url?
Base64url replaces + and / with - and _ and drops the = padding, so the token can go in a URL or file name without escaping.
Is Math.random good enough for tokens?
No. Math.random is not designed for security and can be predictable. This tool uses crypto.getRandomValues instead.