How to use it
- Choose how many random bytes each token should contain. 32 bytes (256 bits) is a safe default for secrets.
- Pick an encoding that suits where the token will be used, and optionally add a prefix such as “myapp_live_”.
- Set how many tokens you need, then copy one or use “Copy all”. Press “Generate again” for a fresh set.
How it works
Tokens are made from random bytes produced by crypto.getRandomValues, the cryptographically secure generator built into your browser and operating system. Math.random is never used.
For hex, Base64 and Base64URL, the tool takes exactly the number of bytes you choose and encodes them, so a 32-byte token always has 256 bits of entropy: 64 hex characters, 44 Base64 characters (including one = of padding) or 43 Base64URL characters. Base64URL replaces + and / with - and _ and drops the padding, so it can be used in URLs, file names and HTTP headers without escaping.
Alphanumeric tokens use only A–Z, a–z and 0–9, which avoids characters that some systems treat specially. Each character carries about 5.95 bits, so the tool draws enough characters to reach at least the chosen number of bits (43 characters for 256 bits). Characters are picked with rejection sampling so all 62 are equally likely.
The prefix is added as plain text and adds no entropy. Prefixes like “sk_live_” make leaked keys easier to recognise and to find with secret scanners. Store secrets in a password manager or secret store, not in source code.
Examples
A webhook signing secret
32 bytes in hex gives a 64-character secret with 256 bits of entropy, which you can paste into both the sender's and the receiver's configuration for HMAC-SHA-256 signatures.
An API key with a recognisable prefix
Choose 24 bytes, Alphanumeric and the prefix “acme_live_”. Each key looks like acme_live_ followed by 33 letters and digits, carries at least 192 bits and is easy to spot in logs or a secret scanner.
A URL-safe reset token
16 bytes in Base64URL gives a 22-character token (128 bits) that can go straight into a link such as /reset?token=… without percent-encoding.
Frequently asked questions
How many bytes should a secret have?
128 bits (16 bytes) is enough to make guessing impossible for tokens like session IDs. For long-lived secrets such as signing keys, 256 bits (32 bytes) is the common recommendation and matches the output size of SHA-256.
Which encoding should I choose?
The entropy is the same for a given number of bytes; only the text form differs. Use hex for maximum compatibility, Base64URL for short tokens in URLs and headers, and alphanumeric when a system rejects punctuation.
Are the tokens stored or logged?
No. They are generated in this browser tab and disappear when you leave the page. They are not sent to a server or included in analytics.
Can I use these as passwords?
Yes, they are random enough, but sites often require a mix of character types. The Password Generator lets you control those rules directly.
Privacy
Tokens are generated in your browser with crypto.getRandomValues. They are not uploaded, stored, logged or sent to analytics; only an anonymous event that the tool was used is recorded.