Random String / Token Generator
Generate random tokens with cryptographically secure browser randomness.
Input & settings
Result
How to use it
- 1Set the shape
Choose the length, how many tokens you need, and the character set.
- 2Generate
Tokens are produced in your browser using the operating system random source.
- 3Copy or download
Take one token, or download the whole batch as a text file.
Good to know
Cryptographically secure
Uses crypto.getRandomValues, the same random source browsers use for security features, not Math.random.
No modulo bias
Rejection sampling keeps every character in your set equally likely, so the entropy figure shown is honest.
Nothing is stored
Tokens are never sent to a server, logged or saved. Reloading the page loses them.
Entropy is per token
The strength shown assumes the whole token is random, which it is here.
Common uses
- API keys and webhook secrets
- Password reset and invitation links
- Temporary passwords for new accounts
- Idempotency keys and request IDs
- Test fixtures that must not collide
Questions
How long should a token be?
For anything that can be guessed online, aim for at least 128 bits of entropy: about 22 characters of URL-safe text or 32 hex characters. The page shows the entropy as you change the settings.
Which character set should I choose?
URL-safe is the easiest to paste into links and headers. Hex is handy when a system expects only 0–9 and a–f.
Are these tokens ever reused?
Each press generates fresh values from the browser random source. Nothing is stored here, so nothing can be handed out twice by this page.
Is it safe to generate production secrets here?
The randomness is suitable, and nothing leaves your browser. Treat the screen and your clipboard as you would any other secret.
How it works
Uses crypto.getRandomValues with rejection sampling to avoid modulo bias. Tokens are not stored or sent to a server. Entropy shown assumes independent, uniformly random characters.