Secure Token Generator
Secure Token Generator produces random tokens for developer use with the browser's Web Crypto API — every byte comes from crypto.getRandomValues(), never from Math.random().
Each token is generated from 32 random bytes (256 bits of random input).
Generated with the browser's cryptographic random number generator (crypto.getRandomValues).
How to use it
- Choose a token length in bytes — 16, 24, 32, 48, 64, or a custom value up to 256
- Pick an output format: Hex, Base64 or Base64URL
- Set how many tokens you need (1 to 20) and select Generate tokens
- Copy a token or Copy all; Regenerate for a fresh set, or Clear to remove them
Choose a length in bytes (16, 24, 32, 48, 64, or a custom value up to 256; 32 bytes is 256 bits of random input), an output format, and how many tokens to generate, then select Generate. Hex gives two lowercase characters per byte; Base64 uses the standard RFC 4648 alphabet with = padding; Base64URL swaps + and / for - and _ and drops the padding, which is handy in URLs and headers. Base64URL is not more secure than Hex — the security comes from the number of random bytes, not the encoding. You can generate one token or up to twenty in a list, copy them individually or all at once, and regenerate. Nothing is stored: the tokens live only on the page and are gone when you reload or clear. Unlike the Password Generator, which builds readable passwords from character sets, or the UUID Generator, which produces identifiers in the UUID format, this tool emits raw random bytes encoded for API keys for your own systems, session secrets, CSRF tokens and test fixtures. Everything runs locally; no token is sent anywhere.
FAQ
Each token is a run of random bytes taken from the browser's Web Crypto API, crypto.getRandomValues(). Math.random() is never used. If a browser does not expose a cryptographic random source, the tool shows an error instead of falling back to a weaker one.
It depends on the use. 16 bytes (128 bits) is a common minimum for API keys and session identifiers; 32 bytes (256 bits) is a frequent choice for longer-lived secrets. The tool shows the byte and bit count next to each length so you can match your own requirements.
They are three ways to write the same random bytes as text. Hex uses two characters per byte. Base64 packs the bytes more compactly with the standard alphabet and = padding. Base64URL is the same as Base64 but uses - and _ instead of + and /, and drops the padding, so it is safe in URLs and HTTP headers.
No. All three formats encode exactly the same random bytes, so a token has the same strength whichever format you pick. The security comes from the number of random bytes, not the encoding. Base64URL is only more convenient in URLs.
No. Tokens are created in your browser and kept only in the page's memory — not in local storage, cookies or any database, and never sent to a server. Reloading or selecting Clear removes them, and analytics records only that the tool was used.