Token generator
Secure random strings for keys, secrets and test data.
Free, no sign-up.
Token generator
How long should a token be?
Strength comes from length and the size of the alphabet. Each letter-or-digit character adds about 6 bits, so the default 32 characters give about 190 bits, far beyond any guessing attack; 22 characters already give about 131. For secrets and API keys, 128 bits or more is a common target.
Every character is drawn from your browser's cryptographic random generator, with no character more likely than another: random bytes that would favor some characters are thrown away and drawn again. Nothing is sent anywhere.
Tokens and passwords
A token like this is good for machines: API keys, webhook secrets, test data. For a password a person has to type, a password manager is the better tool, because it makes, stores and fills a different long password for every site. If you must remember one, several random words are easier to type than a string of symbols and can be just as strong.
More developer tools
- Base64 encode and decode: Decode Base64 to text, or encode text as standard or URL-safe Base64.
- URL encode and decode: Make text safe for a URL, or turn percent-encoded text back into words.
- JSON formatter: Check JSON, see where it breaks, then format it for reading or minify it.
- JWT decoder: Read a JSON Web Token’s header, claims and times without sending it anywhere.
- UUID generator: Random version 4 UUIDs, one or up to fifty at a time.
- SHA-256 hash: The SHA-256 digest of any text as you type, with SHA-1, SHA-384 and SHA-512 beside it.
- All developer tools on one page
Make a random token for an API key, a webhook secret or test data. Each character is picked with a cryptographically secure generator from letters and digits, or from your own set of characters.
How it works
- Choose the length — From 8 to 128 characters.
- Pick the characters — Leave blank for letters and digits, or type your own set.
- Generate and copy — Each press makes a new token.
Examples
- 32 letters and digits — About 190 bits of randomness
- Hex only — Alphabet 0123456789abcdef
FAQ
- How is it generated? — In your browser, with its cryptographically secure random generator; every character is equally likely.
- Is it stored? — No. It is made on your device and never sent anywhere.
- How long should a key be? — 32 letters and digits is plenty for most API keys and secrets.