tool
Token Generator
Generate secure random secrets, API keys, UUIDs and custom tokens directly in your browser. Nothing is sent to a server.
configure your options and generate a token
Tokens are generated locally in your browser using cryptographically secure browser APIs.
Generate secure random tokens, secrets and UUIDs
Create random values for JWT secrets, session keys, API keys, webhook signing secrets, invite codes, test data and UUID primary keys. Pick a format, set the length (4–256 characters) and how many you need (up to 100 at once), and generate. Values come from the Web Crypto API (crypto.getRandomValues() and crypto.randomUUID()), a cryptographically secure random source built into every modern browser, and they are created on your device without touching a server.
What can you do?
- 1. Nine token formats
Secure secret, API key, UUID v4, hex, Base64, URL-safe Base64, numeric, alphanumeric and fully custom character sets. - 2. Fine-grained character control
For secrets and API keys, choose lowercase, uppercase, numbers and symbols, or exclude look-alike characters (0, O, 1, l, I) for codes people have to read or type. - 3. Add a prefix
Prepend a label such as sk_live_ or whsec_ so keys are easy to recognise in logs and easy for secret scanners to detect. - 4. Entropy shown for every setting
See the approximate strength of the current configuration in bits, so you can tell immediately whether a token is strong enough. - 5. Bulk generate, copy and download
Generate up to 100 values, copy one or all of them, or download the list as a text file, separated by new lines, commas or spaces.
Why use a cryptographically secure generator?
Functions like Math.random() are designed for speed, not secrecy. Their output can be predictable, which is unacceptable for anything that protects access, such as password-reset links, API keys or the secret that signs your JWTs.
This tool draws every character from the browser's cryptographically secure random number generator and uses rejection sampling, so every character in the chosen set is equally likely and there's no hidden bias toward some characters.
How to generate a secure token
- 1. Pick a format
Choose the format your application expects, using the table below if you're unsure. - 2. Set length and count
Length is measured in characters. Check the entropy readout and aim for at least 128 bits for secrets. - 3. Adjust characters or add a prefix
Exclude ambiguous characters for human-readable codes, or add a prefix to identify the key type. - 4. Generate and store it safely
Copy the value straight into your environment variables or secret manager, never into source code.
Which token format should you use?
| Format | Characters | Bits per character | Good for |
|---|---|---|---|
| UUID v4 | Hex digits and hyphens, fixed 36 characters | 122 bits total | Database IDs, request and correlation IDs |
| Hex | 0–9, a–f | 4 | Secrets in config files, checksums, hex-encoded keys |
| Base64 | A–Z, a–z, 0–9, + and / | 6 | Compact secrets stored in environment variables |
| URL-safe Base64 | A–Z, a–z, 0–9, - and _ | 6 | Tokens in URLs, cookies and email links |
| Alphanumeric | A–Z, a–z, 0–9 | ≈5.95 | API keys, invite codes, IDs without symbols |
| Secret / API key | Your choice of letters, numbers and symbols | Up to ≈6.4 with all sets | Signing keys, passwords for services |
| Numeric | 0–9 | ≈3.32 | One-time codes and PINs |
| Custom | Any characters you type | log₂ of the set size | Matching a format required by another system |
How long should a secret be?
Entropy, measured in bits, is what makes a token hard to guess. Each extra bit doubles the number of possible values. These lengths reach roughly 128 and 256 bits:
| Format | ≈128 bits | ≈256 bits |
|---|---|---|
| Hex | 32 characters | 64 characters |
| Base64 / URL-safe Base64 | 22 characters | 43 characters |
| Alphanumeric | 22 characters | 43 characters |
| Numeric | 39 digits | 78 digits |
128 bits is a comfortable minimum for API keys and session tokens. For HMAC signing secrets such as an HS256 JWT secret, use at least 256 bits, e.g. a 64-character hex string. Short numeric codes are only safe when the server limits how many guesses are allowed.
Example: adding generated secrets to a .env file
Generate each value separately and keep the file out of version control:
These are illustrative values only. Never reuse a secret you have seen published anywhere, including in examples.
Frequently asked questions
Are the tokens really random and private?
Yes. They are generated in your browser with the Web Crypto API, which is designed for cryptographic use, and they are never sent to or stored on a server. Nothing is generated until you click the button on your own device.
What's the difference between a UUID and a random token?
A UUID v4 is a standardised 128-bit identifier with 122 random bits in a fixed format, ideal as a unique ID. It isn't designed to be a secret. For anything that grants access, use a longer hex or Base64 secret instead.
Should I include symbols in an API key?
Usually not. Symbols can break URLs, shell commands and config files unless they are escaped. Longer alphanumeric or URL-safe Base64 keys give the same strength without the escaping headaches.
Why exclude ambiguous characters?
0 and O, or 1, l and I, look alike in many fonts. Excluding them makes codes that people read aloud or type by hand, such as voucher or invite codes, much less error-prone, at the cost of a tiny reduction in entropy per character.
Can I use this as a password generator?
Yes. Choose the secret format with all character sets enabled and a length of 16 or more. Store the result in a password manager rather than reusing it.
Related tools
Need to check a token format? Validate it with the regex tester.
- Regex Tester – Test JavaScript regular expressions with live highlighting.
- QR Code Generator with Logo – Create a QR code from a URL or text, with an optional logo.
- JSON Formatter & Validator – Pretty-print, validate and minify JSON.