Secure Token Generator
Generate secrets for session tokens, password-reset links, signing keys, JWT and HMAC secrets and environment variables. Choose the strength in bits and the encoding, add a prefix, and copy — every token comes from the browser's cryptographically secure random generator.
Choose the strength (256 bits is a safe default for secrets) and the encoding — hex for config files, Base64url for URLs and JWT secrets, Base32 for TOTP-style secrets — then copy one or several tokens. Tokens are generated locally with crypto.getRandomValues and never sent anywhere.
Secure tokens
256 bits from crypto.getRandomValues, generated in your browser and never sent anywhere. 128 bits or more is infeasible to guess.
Zero Server Uploads
Files process in local RAM
Instant WASM Speed
No waiting queues or lags
Unlimited Batching
Convert files without limits
Suggest a Feature or Improvement for Secure Token Generator
Need custom options, higher limits, or extra format support? Let our engineering team know!
How to use Secure Token Generator
- 1Choose the strength in bits.
- 2Choose the encoding.
- 3Optionally add a prefix.
- 4Copy the token into your config or secret manager.
How strong should a token be?
128 bits of randomness is infeasible to guess; 256 bits is the common choice for signing keys (HS256 secrets, Rails/Django secret keys, NextAuth secrets). The encoding doesn't change the strength — 256 bits is 64 hex characters or 43 Base64url characters.
Equivalent commands: openssl rand -hex 32, or python -c "import secrets; print(secrets.token_urlsafe(32))".
Handling secrets
Store secrets in environment variables or a secret manager, never in source code. Rotate them if they leak. For customer-facing keys with prefixes and checksums use the API Key Generator.
Frequently Asked Questions
Is it safe to generate secrets in a browser?
Yes — the Web Crypto API provides the same quality of randomness as OpenSSL. Nothing leaves your device. For the highest assurance, you can also generate secrets directly on the server that uses them.
Which encoding should I use?
Hex is the most portable; Base64url is shorter and URL-safe; Base32 is case-insensitive and used for TOTP secrets.
Is my data sent to your server?
No. This tool runs entirely in your browser using the Web Crypto API and JavaScript. Nothing you type or generate is uploaded, logged or stored.
Related Tools
API Key Generator
Generate secure API keys with a prefix and optional checksum, like sk_live_… keys.
CSRF Token Generator
Generate secure CSRF tokens and copy correct server-side code for Node, Python, PHP, Go and Java.
Random String Generator
Generate random strings of any length from letters, numbers, hex, symbols or your own characters.