Random Token Generator
Cryptographically secure tokens in hex, base64url, alphanumeric, or numeric
Everything runs in your browser. Your data never leaves your device.
Related tools
How to use
Secure tokens must be unpredictable and unique. This tool uses the cryptographic random number generator built into every modern browser, the same source used by TLS to generate session keys.
Choose the output format
Hex produces a string of 0–9 and a–f characters — two hex digits per byte, so 32 bytes gives 64 characters. Base64url is more compact and safe for URLs and HTTP headers. Alphanumeric uses 0–9 and a–z. Numeric produces digits only.
Set the byte length
Byte length controls how much entropy the token carries, not the number of output characters. 16 bytes gives 128 bits of entropy — the standard recommendation for session tokens. 32 bytes gives 256 bits, suitable for long-lived API keys.
Set the count and generate
Set the count from 1 to 20 to generate multiple tokens at once. Each token is independently random. Click Generate and then use the copy button to capture all tokens or click the individual copy icon next to each one.
Examples
Session token for a web application
Select hex format, set byte length to 32, and generate one token. The resulting 64-character hex string provides 256 bits of entropy — sufficient for a secure session identifier that can be stored in an HttpOnly cookie.
Batch API keys for testing
Set format to alphanumeric, byte length to 24, and count to 10 to generate ten distinct API keys in one click. Useful when provisioning test accounts or seeding a staging environment without writing custom scripts.
About this tool
Generate one or more cryptographically secure random tokens using crypto.getRandomValues. Choose your output format — lowercase hexadecimal, URL-safe base64, alphanumeric, or digits-only — set the byte length from 8 to 128, and generate up to 20 tokens at once. Hex tokens at 32 bytes produce the 64-character strings common for session IDs and API keys. Base64url tokens are compact enough for Authorization headers. All generation happens in the browser; nothing is uploaded.