Token Generator

Generate a random token of 1 to 512 characters — an API key, a session or CSRF token, a webhook signing secret, a SECRET_KEY for your framework. Built in your browser with a cryptographic random number generator and never transmitted.

How to use it

1. Drag the token length slider. 32 characters is a reasonable minimum for a secret; 64 is the default here and a common choice for API keys.
2. Choose the character types: lowercase, uppercase, numbers (all on by default) and symbols (off by default).
3. Click Generate token, then copy it — or download it as a text file.

Symbols are off by default on purpose. Tokens usually end up in URLs, HTTP headers, .env files and shell commands, where punctuation needs quoting or escaping. An alphanumeric token of the same length is only marginally shorter in entropy and far easier to move around safely.

Frequently asked questions

How long should an API token be?

Aim for at least 128 bits of entropy. With a 62-character alphanumeric alphabet, each character is worth about 5.95 bits, so 22 characters clears 128 bits and 32 characters gives you roughly 190 bits — comfortable for anything. The 64-character default is well past the point where brute force is even theoretically interesting; the extra length mostly buys you room for prefixes and rotation schemes.

What is the difference between a token and a password?

A password is typed by a human and stored (hashed) by a server. A token is generated by a machine, handed to a client, and presented on every request. That means a token can — and should — be long and unmemorable. It also means a token belongs in a secrets manager or an environment variable, never in source control.

Can I use this for a Django SECRET_KEY, a JWT signing secret, or a CSRF token?

Yes. All three want the same thing: a long, unpredictable string from a cryptographic source. Generate 50–64 characters and paste it into your configuration. For a JWT signing secret specifically, use at least 32 characters (256 bits) so it matches the strength of HS256.

Should I add a prefix to my tokens?

If you are issuing tokens for your own API, prefixing them (sk_live_…, ghp_…) makes them recognisable in logs and lets secret scanners spot a leaked key. Generate the random part here and prepend your prefix — the prefix adds no entropy, so do not shorten the random part to make room.

How random are these tokens?

Every character is drawn from crypto.getRandomValues — the platform's cryptographically secure random number generator — with rejection sampling, so every character in the alphabet is exactly equally likely. Math.random() is never used: it is predictable and unfit for generating secrets.

How do I rotate a token?

Generate a new one, deploy it alongside the old one, switch traffic over, then revoke the old one. Keeping both valid briefly avoids downtime — which is why token systems accept a set of valid keys rather than a single value.

Privacy

The token is generated entirely on your device. Nothing is sent to a server, nothing is logged, and nothing is stored. Generated tokens are excluded from shareable links by design: a share link carries your settings only, never the secret.