Random Token Generator

Generate cryptographically secure random tokens in hex, base64, base64url, or UUID format, using the browser's CSPRNG.

How it works

• Every token is built from crypto.getRandomValues, the browser's cryptographically secure random source (CSPRNG).
• The selected encoding maps the raw bytes to text: hex uses 2 characters per byte, base64 uses 4 characters per 3 bytes, base64url is the URL-safe variant without padding, and UUID is a formatted 16-byte hex string.
• Entropy is set by the byte length, not the encoding — 16 bytes is 128 bits of randomness.
• Generation happens entirely on your device; nothing is transmitted or stored.

About Random Token Generator

Random tokens are unpredictable strings used as credentials or one-time references: API keys, CSRF tokens, session identifiers, password-reset links, and email-verification codes. Their strength depends on how many bits of entropy they hold — 16 bytes (128 bits) is a common default, and 16–32 bytes is ample for most purposes. The encoding only changes the text length, not the entropy: hex renders 2 characters per byte (a 16-byte token becomes 32 characters), while base64 renders 4 characters per 3 bytes (24 characters, 22 without padding); base64url swaps + / for - _ and drops the padding so the token is safe in URLs, query strings, and filenames.

Use this generator whenever you need a fresh random credential: a new API key, a session id, a CSRF token, or a one-time reset link. Entropy must come from a cryptographically secure source — this tool uses crypto.getRandomValues, while Math.random is not designed for security and must never be used for secrets. Store tokens the way you store passwords: hash them in the database so a leak does not expose working credentials, transmit them over HTTPS, and treat anything that cannot be re-derived (like a reset link) as single-use.