Token Generator

Generate random tokens and strings in hex, alphanumeric, URL-safe, and custom character set formats.

Token Generator tool

Loading...

Example

Input: Length 32, format Hexadecimal, count 1, then Generate Token

Result: One random 32-character lowercase hex token (characters 0-9 and a-f), different on every run

Each character comes from crypto.getRandomValues. 32 hex characters carry 128 bits of randomness, enough for API keys and session tokens.

Token Length Needed by Format

FormatSymbolsBits per character128-bit length256-bit length
Hexadecimal1643264
Alphanumeric625.952243
URL-safe6462243
Base646462243

Computed as log2(symbols) per character, rounded up to whole characters.

  1. Choose the format: hexadecimal, alphanumeric, URL-safe, Base64 or custom character set.
  2. Set the length (8 to 256 characters) with the slider.
  3. For a custom set, type the characters to use in the Custom Charset field.
  4. Set the Count (up to 100) and click Generate.
  5. Copy one token or all of them with the copy buttons.

Random Token Length and Format Guide

This generator makes random tokens for API keys, session IDs, reset links and invite codes. For anything that protects access, aim for at least 128 bits of randomness. That is 32 hex characters or 22 URL-safe characters.

The format decides how many bits each character carries. Hex uses 16 symbols, so each character is worth 4 bits. Alphanumeric uses 62 symbols, about 5.95 bits each, and URL-safe and Base64 use 64 symbols, 6 bits each. A custom set of N characters gives log2(N) bits per character. Repeated characters in a custom set are removed, so they do not tilt the odds.

Pick the format for where the token will live. Hex is safe everywhere and easy to read in logs. URL-safe uses letters, digits, hyphen and underscore, so it fits into links and file names without escaping. The Base64 option uses standard Base64 with + and /, which must be escaped in URLs, so prefer URL-safe there. Alphanumeric suits codes that people may type.

Random values come from crypto.getRandomValues. For the alphanumeric, URL-safe and custom sets, the tool uses rejection sampling, which throws away values that would make some characters more likely than others. Length runs from 8 to 256 characters, and you can make up to 100 tokens at once and copy one or all. Nothing is sent to a server.

On your server, store a hash of each API key rather than the key itself, so a database leak does not expose working keys. If you need a standard ID format, use the UUID Generator. For passwords that people type, use the Password Generator.

Sources

Frequently Asked Questions

Use at least 128 bits of randomness, which is 32 hex characters or 22 alphanumeric or URL-safe characters. That makes guessing a valid token hopeless, even across billions of tokens. Many services use 256 bits (64 hex characters) for long-lived keys. Short codes of 8 to 12 characters are fine only when they expire fast and attempts are limited.
Choose by where the token goes. URL-safe is best for links, cookies and file names because it needs no escaping. Hex is longer for the same strength but works everywhere and is easy to read. Standard Base64 includes + and /, which cause trouble in URLs, so use it only where your system expects Base64.
Yes. They come from crypto.getRandomValues, the cryptographically secure random generator built into browsers, not from Math.random. The tool also avoids modulo bias, a subtle flaw that makes some characters slightly more common. The tokens are suitable for API keys, session IDs and reset links, as long as you store and send them safely.
A UUID has a fixed format of 36 characters with hyphens. A version 4 UUID carries 122 random bits. A token from this tool can be any length and character set, so you can get 128 bits in 22 characters or 256 bits in 43. Use UUIDs for database IDs that need a standard shape, and tokens for secrets.
Store a hash, not the key. Because a random 128-bit token cannot be guessed, a fast hash such as SHA-256 is enough here, unlike with passwords. When a request comes in, hash the key it sends and look up the hash. Show the full key to the user once at creation, and keep only a short prefix for display.

Related Tools

Password Generator

Generate strong, secure passwords with customizable length, character types, and multi-word passphrases.

Security and Encryption

UUID Generator

Generate random UUIDs in v4 and v7 formats with bulk generation and one-click copy support.

Developer Tools

Hash Generator

Create MD5, SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files, right in your browser.

Security and Encryption

Basic Auth Generator

Generate Base64-encoded Basic Authentication headers from username and password credentials.

Security and Encryption

OTP Code Generator and Validator

Generate and validate TOTP codes compatible with Google Authenticator and other authenticator apps.

Security and Encryption

Bcrypt Hash Generator and Verifier

Generate bcrypt hashes with configurable rounds and verify passwords against existing bcrypt hashes.

Security and Encryption