Token Generator
Random API keys, invite codes, secrets, and share-link slugs, pick a charset preset or compose your own, length up to 512 characters.
Up to 512 charsCustom charsetsClient-sideFree to use
Preset
Length
Custom
Count1
How to use
- Pick a preset or charset. URL-safe, alphanumeric, hex, base62, or compose your own.
- Set length and count. 1–512 characters per token, 1–50 tokens per batch.
- Click Generate. Each token is independently random and shown one per line.
Common use cases
- Provisioning API keys and webhook secrets
- Creating invite codes and share-link slugs
- Generating random fixture IDs for tests
- Filling in secret values during local setup
Frequently asked questions
- What is this tool best for?
- It is designed for generating secrets that machines read: API keys, webhook signing secrets, session tokens, CSRF tokens, and invite codes. Because tokens have no structure or meaning, they are easy to revoke and rotate without any coordination overhead.
- Is the output cryptographically secure?
- Yes. Token generation uses crypto.getRandomValues under the hood, which is the browser's cryptographically secure pseudorandom number generator (CSPRNG). The output is suitable for use as a secret, unlike Math.random() which is not cryptographically secure.
- Does this tool send generated tokens to a server?
- No. All randomness is generated in the browser. Nothing is transmitted anywhere.
- How is this different from a UUID v4?
- A UUID v4 is 122 bits of randomness packed into a fixed 36-character hyphenated format with version and variant bits baked in. Tokens generated here have no internal structure, can be any length, and use any charset, giving you more control over format and entropy. For most API key use cases, tokens are a better fit than UUIDs.
- Should I use this to generate passwords for users?
- Not directly. Random hex or base64 strings are difficult for humans to memorise or type. For human-facing passwords, use the password generator. For machine-readable secrets where a human never types them manually, this tool is the right choice.
Related tools
How to use
- Pick a preset or charset. URL-safe, alphanumeric, hex, base62, or compose your own.
- Set length and count. 1–512 characters per token, 1–50 tokens per batch.
- Click Generate. Each token is independently random and shown one per line.
Common use cases
- Provisioning API keys and webhook secrets
- Creating invite codes and share-link slugs
- Generating random fixture IDs for tests
- Filling in secret values during local setup
Frequently asked questions
- What is this tool best for?
- It is designed for generating secrets that machines read: API keys, webhook signing secrets, session tokens, CSRF tokens, and invite codes. Because tokens have no structure or meaning, they are easy to revoke and rotate without any coordination overhead.
- Is the output cryptographically secure?
- Yes. Token generation uses crypto.getRandomValues under the hood, which is the browser's cryptographically secure pseudorandom number generator (CSPRNG). The output is suitable for use as a secret, unlike Math.random() which is not cryptographically secure.
- Does this tool send generated tokens to a server?
- No. All randomness is generated in the browser. Nothing is transmitted anywhere.
- How is this different from a UUID v4?
- A UUID v4 is 122 bits of randomness packed into a fixed 36-character hyphenated format with version and variant bits baked in. Tokens generated here have no internal structure, can be any length, and use any charset, giving you more control over format and entropy. For most API key use cases, tokens are a better fit than UUIDs.
- Should I use this to generate passwords for users?
- Not directly. Random hex or base64 strings are difficult for humans to memorise or type. For human-facing passwords, use the password generator. For machine-readable secrets where a human never types them manually, this tool is the right choice.