Random Token & API Key Generator
Developers constantly need random values that are hard to guess: API keys, session identifiers, CSRF tokens, nonces, and password-reset links. This generator produces cryptographically secure random tokens in the format you need — hexadecimal, Base64URL (safe for URLs and headers), or plain alphanumeric — at a length you control. Base64URL is ideal for tokens that appear in query strings; hex is convenient for keys and IDs; alphanumeric avoids special characters entirely.
Every value is drawn from the browser's secure random source (crypto.getRandomValues), which is suitable for security-sensitive use, unlike Math.random. Generation happens entirely on your device and nothing is transmitted or stored, so you can safely create production secrets without them touching a third-party server. Pick a format and length, generate, and copy the token straight into your config, .env file, or code.
Generate cryptographically secure random tokens and API keys. Examples are generated on load — adjust the options and regenerate. Nothing is uploaded.
Frequently asked questions
- Are these tokens safe for production secrets?
- Yes. They use the Web Crypto API's cryptographically secure random generator, which is appropriate for API keys, session IDs, and other secrets.
- Which format should I pick?
- Use hex for keys and identifiers, Base64URL for tokens that appear in URLs or headers, and alphanumeric when you need to avoid symbols entirely.
- Is anything sent to a server?
- No. Tokens are generated locally in your browser and never transmitted or stored, so even production secrets stay private.
- How long should a token be?
- For security-sensitive uses aim for at least 128 bits of entropy — for example 32 hex characters or 22 or more Base64URL characters. Longer is fine.
- What is wrong with Math.random for tokens?
- Math.random is not cryptographically secure and can be predictable. This tool uses crypto.getRandomValues, which is designed for security-sensitive randomness.