Secure Random Token & API Key Generator

• Generates cryptographically secure random tokens
• Multiple formats: hex, Base64, Base64URL, and alphanumeric
• Configurable token length from 16 to 256 characters
• Suitable for API keys, session tokens, CSRF tokens, and secrets
• Uses Web Crypto API — all generation runs securely in your browser

Use Cases

Frequently Asked Questions

Are these tokens truly random and secure?

Yes. Tokens are generated using the Web Crypto API (crypto.getRandomValues) which provides cryptographically secure pseudo-random numbers, not Math.random().

What token length should I use for API keys?

32 characters in hex format provides 128 bits of entropy, suitable for most API keys. Use 64+ characters for signing secrets and HMAC keys.

Can I add a prefix like sk_ to generated tokens?

Yes. You can add custom prefixes and suffixes to match naming conventions like Stripe (sk_live_), OpenAI (sk-), or your own format.

Which format should I use: hex, Base64, or alphanumeric?

Hex is standard for HMAC keys and signing secrets. Base64 is compact for JWTs and cookies. Alphanumeric is human-readable for API keys shared with users.

Should I store generated tokens in source code?

Never. Store secrets in environment variables, .env files (gitignored), or a secrets manager like AWS Secrets Manager or HashiCorp Vault.

Can I generate multiple tokens at once?

Yes. Use bulk generation to create multiple unique tokens for provisioning multiple API keys, test accounts, or environment configs simultaneously.