Are generated tokens logged or saved on your servers?

No. The token generator executes entirely inside your client browser session using the Web Crypto API. No token data ever leaves your computer.

What is the difference between Base64 and Base64URL?

Standard Base64 contains '+' and '/' characters and '=' padding, which require percent-encoding when placed in URLs. Base64URL replaces '+' with '-' and '/' with '_', and omits padding, making it safe for query parameters, cookies, and HTTP headers.

How many bits of entropy should I use for an API key?

For production API keys and webhook signing secrets, 256 bits (32 bytes) is the industry standard. For short-lived session tokens, 128 bits (16 bytes) is generally sufficient.

Can I use these tokens for cryptographically secure HMAC hashing?

Yes. Hexadecimal and Base64 tokens generated at 32 bytes (256 bits) or 64 bytes (512 bits) meet the entropy requirements for HMAC-SHA256 and HMAC-SHA512 secret keys.

Are UUIDs generated by this tool compliant with RFC 4122?

Yes. Version 4 UUIDs conform strictly to RFC 4122, with bits 4-7 of the 7th byte set to 0100 (version 4) and bits 6-7 of the 9th byte set to 10 (variant 1).

SECURITY & PRIVACY

🔑

Random Token Generator

Generate high-entropy random tokens, API keys, webhook secrets, session IDs, and UUIDs in Hex, Base64URL, or Alphanumeric encodings.

✓100% In-Browser Cryptographic RNG

✓Zero Server Logging or Persistence

✓Raw OS Entropy via Web Crypto

Cryptographic Token Engine

Uniform entropy generation for web APIs, HMAC keys, OAuth bearer tokens, and session identifiers.

hexCalculatingCSPRNG

Generated Cryptographic Token

Generating...

Token Format & Rules

Presets:

Encoding Format

Entropy Seed Size: 32 bytes (256 bits)Range: 8 – 128 bytes

Case Formatting

Batch Generation Quantity: 1

Cryptographic Architecture

256-bit Security: 32-byte tokens provide $2^256$ combinatorial states, impervious to modern brute-force searches.

URL-Safe By Default: Base64URL and NanoID tokens avoid +, /, and = characters, safe for query params and headers.

Zero Telemetry: All generation occurs inside browser memory with zero network requests.

Cryptographic API Token and Secret Generator

The Random Token Generator produces high-entropy cryptographic strings designed for developer workflows, backend APIs, webhook signatures, session tokens, and security testing. It uses browser-native Web Crypto CSPRNG APIs to guarantee uniform entropy without server round-trips.

Different engineering systems require distinct string representations. This utility supports standard hexadecimal (popular for HMAC keys, SHA digests, and CSRF secrets), URL-safe Base64URL (ideal for OAuth bearer tokens and JSON Web Token secrets), standard Base64, raw alphanumeric strings, compact NanoIDs, and RFC 4122 Version 4 UUIDs.

Configurable byte length ranges (from 8 to 128 bytes) let developers calibrate exact bit-depth requirements. from standard 128-bit session IDs to high-assurance 256-bit and 512-bit signing keys. Batch creation with unformatted text downloads streamlines rapid local provisioning.

Core Tool Capabilities

Multi-Format Binary Encodings: Generate tokens formatted in Hexadecimal, Base64, URL-Safe Base64URL, Alphanumeric, NanoID, or RFC 4122 UUIDv4.
Calibrated Byte and Bit Depths: Adjust exact seed entropy from 8 bytes (64 bits) up to 128 bytes (1024 bits) for maximum cryptographic compliance.
Developer Preset Architectures: Quick-select configurations for 256-bit API secrets, OAuth Bearer tokens, Webhook secrets, and NanoID slugs.
URL-Safe Encoding by Default: Base64URL and NanoID formats automatically omit characters requiring percent-encoding or header escaping.
Bulk Token Provisioning: Generate up to 50 tokens in a single batch, with individual copy shortcuts and plain-text file download.
Hardware-Seeded Entropy: Every byte is gathered directly from the operating system's kernel entropy pool using crypto.getRandomValues.

Local Browser Privacy

Your files are processed locally on your device. Files are not uploaded, transmitted, or stored on remote servers.

Once the page has loaded, you can disconnect your network connection and continue using this tool offline.

Target Use Cases

• Backend API Key & Secret Generation
• Webhook HMAC Signing Secrets
• OAuth 2.0 Bearer Tokens & State Nonces
• Database Test Fixtures & Seed Data

Technical Specifications & Platform Limits

Supported Formats

Hex, Base64, Base64URL, Alphanumeric, NanoID, UUIDv4

Comprehensive encoding suite for modern backend and web protocols.

Randomness Standard

Web Crypto CSPRNG (crypto.getRandomValues)

Hardware-seeded pseudo-random number generator.

Entropy Depth Range

64 to 1024 bits (8 to 128 bytes)

Scalable cryptographic strength for session cookies up to master signing keys.

UUID Specification

RFC 4122 Version 4

Compliant pseudo-random 128-bit universally unique identifier.

Execution Environment

Client-side Local Memory

Tokens are generated entirely in browser RAM without server calls.

Step-by-Step Workflow

Select Encoding Format

Choose Hex for API keys, Base64URL for web tokens and cookies, Alphanumeric for readable strings, or UUID for entity IDs.

Configure Byte or Character Length

Set the desired entropy size (32 bytes / 256 bits is standard for symmetric keys and HMAC signing).

Select Batch Quantity

Choose whether you need a single credential or a batch of up to 50 tokens for staging test environments.

Copy or Download Tokens

Copy individual tokens directly to your clipboard or download the full batch as a text file for environment variable setup.

Practical Real-World Use Cases

Backend API Key & Secret Generation

Generating 256-bit hexadecimal credentials for internal microservice communication and partner API integrations.

Webhook HMAC Signing Secrets

Creating high-entropy shared secret keys used to verify Stripe, GitHub, or Shopify webhook signatures.

OAuth 2.0 Bearer Tokens & State Nonces

Creating URL-safe Base64URL tokens for OAuth state verification, authorization codes, and PKCE code verifiers.

Database Test Fixtures & Seed Data

Generating batches of realistic, high-entropy unique tokens and UUIDs for automated test suites and local staging databases.

Frequently Asked Questions

Are generated tokens logged or saved on your servers?: No. The token generator executes entirely inside your client browser session using the Web Crypto API. No token data ever leaves your computer.
What is the difference between Base64 and Base64URL?: Standard Base64 contains '+' and '/' characters and '=' padding, which require percent-encoding when placed in URLs. Base64URL replaces '+' with '-' and '/' with '_', and omits padding, making it safe for query parameters, cookies, and HTTP headers.
How many bits of entropy should I use for an API key?: For production API keys and webhook signing secrets, 256 bits (32 bytes) is the industry standard. For short-lived session tokens, 128 bits (16 bytes) is generally sufficient.
Can I use these tokens for cryptographically secure HMAC hashing?: Yes. Hexadecimal and Base64 tokens generated at 32 bytes (256 bits) or 64 bytes (512 bits) meet the entropy requirements for HMAC-SHA256 and HMAC-SHA512 secret keys.
Are UUIDs generated by this tool compliant with RFC 4122?: Yes. Version 4 UUIDs conform strictly to RFC 4122, with bits 4-7 of the 7th byte set to 0100 (version 4) and bits 6-7 of the 9th byte set to 10 (variant 1).