Token generator
Generate random string with the chars you want, uppercase or lowercase letters, numbers and/or symbols.
About Token generator
Generates a random string from the character sets you choose. It is meant for things like API keys, session secrets, test fixtures and one-time identifiers, using the browser's cryptographically secure random source.
When you would use it
- Creating an API key, webhook secret or session secret for an application's configuration.
- Generating a random string of an exact length for test data or a temporary identifier.
- Making a token restricted to letters and digits when a system rejects symbols.
How to use it
- Switch the character sets on or off: uppercase, lowercase, numbers, symbols.
- Drag the slider to set the length (1 to 512, default 64).
- Copy the token, or press the refresh button (Ctrl+Enter also works) to get a new one.
Things worth knowing
- Randomness comes from the browser's crypto.getRandomValues with rejection sampling, so every character is equally likely. It never uses Math.random.
- Strength depends on length and alphabet size. A 64-character token from letters and digits carries roughly 380 bits of entropy, far more than most systems need; 32 characters is already plenty for a secret.
- If all four character sets are off, the result is empty.
- Settings are stored in the page address, so a bookmarked link reopens with the same options. The generated token itself is never put in the address.
Frequently asked questions
- Is the token sent anywhere?
- No. It is generated in your browser and is not uploaded or stored. Copy it and keep it in a secrets manager.
- Should I use this for user passwords?
- For passwords people have to type or remember, use the password generator, which can avoid look-alike characters. This tool is for machine-to-machine secrets.