Token Generator
Generate secure random tokens and API keys.
Options
Configure token generation
Generated Tokens
5 token(s) of 32 characters
Security Information
About the Token Generator
API keys, session tokens, secrets for CI pipelines and service-to-service auth all need high-quality randomness. A token generator should use a cryptographic random source - not Math.random(), which is predictable and never safe for authentication material.
This generator uses the browser Web Crypto API (crypto.getRandomValues), the same source browsers use for TLS. Choose hex or base64 output, any length, or define a custom alphabet - useful for URLs-safe tokens or license-key formats like XXXX-XXXX-XXXX.
How to use
- Pick the output format: hex, base64, or a custom alphabet.
- Set the token length in characters (32-64 is typical for API keys).
- Generate one token or a batch.
- Copy the result straight into your config or secrets manager.
Frequently Asked Questions
Are these tokens safe to use as API keys? ▾
Yes. They are generated with crypto.getRandomValues, the browser cryptographic random source. For production systems, prefer generating secrets server-side or in a secrets manager so nothing transits a browser.
How long should an API token be? ▾
32 characters of hex (128 bits) is the practical minimum for API keys; 64 hex characters is common. For 256-bit keys use 64 hex characters or 43 base64 characters.
What is the difference between a token and a UUID? ▾
A UUID encodes structure (version bits, sometimes a timestamp) and is not meant to be secret. A random token is unstructured and unpredictable - use tokens for secrets, UUIDs for identifiers.