Local Tools Online

Token Generator

Generate random strings for API keys, session tokens, or one-off secrets, with full control over length and character set — computed using your browser’s cryptographically secure random number generator, not a predictable pseudo-random function.

Where “just make something random” actually needs more care than it sounds

Not every random-looking string is created equally random under the hood, and for anything functioning as a real secret — an API key, a session token, a webhook signing secret — the quality of the randomness source matters directly to how guessable the result actually is to an attacker. This tool uses the Web Crypto API’s crypto.getRandomValues(), a cryptographically secure source, rather than a basic random function, and lets you tune exactly which character sets go into the result depending on where the token needs to go — some systems are picky about symbols, some require a specific length, and some expect a particular prefix format.

How to use it

  1. Set the desired token length using the slider or direct input.
  2. Choose which character sets to include — uppercase letters, lowercase letters, numbers, and symbols — individually, matching whatever the destination system requires or restricts.
  3. Choose a preset format if you need one: hex-only (common for API keys and session identifiers), alphanumeric-only (common where symbols would break URL or header compatibility), or fully custom character selection.
  4. Add an optional prefix (like sk_live_ or tok_) automatically prepended to the generated random portion, matching the convention many API platforms use to make token type identifiable at a glance.
  5. Generate a batch of multiple tokens at once if you need several distinct values, and copy them individually or as a full list.

Common situations this solves

  • Generating a local development or test API key that mimics the format of a production key without needing to request one from a live system.
  • Creating a webhook signing secret or session token during local development or infrastructure setup, before wiring up a proper secrets management system.
  • Generating a one-time-use invite code or reset token for an application feature, with a controlled length and character set matching what the URL or database column expects.
  • Testing how an application handles tokens of unusual length or character composition, useful for validating input handling and edge cases during development.
  • Producing example/placeholder API keys for documentation, where you want something that looks realistic without it being a real, live credential.

Frequently asked questions

How is this different from the UUID generator?

A UUID follows a fixed, standardized structure (128 bits, formatted with specific hyphen placement, following one of several defined “versions”) designed specifically for uniqueness across distributed systems. A general-purpose token has no fixed structure — length and character set are entirely up to you and whatever the destination system expects, which makes this the more flexible choice when you need to match a specific format rather than the standard UUID shape.

Is a randomly generated token automatically secure just because it’s random?

Randomness quality matters, but so does length — a very short token, even generated from a perfectly secure random source, can still be brute-forced simply because there aren’t many possible combinations to check. For anything functioning as a real security credential, longer is meaningfully safer, and this tool’s live character-set and length controls let you reason about the total combination space directly rather than guessing.

Can I use this to generate a token that matches a specific API’s exact format requirements?

In most cases yes — use the prefix field for a fixed leading string, set the exact length the platform expects for the random portion, and restrict the character set to match (many APIs specifically use hex or base62-style alphanumeric tokens). If a platform has a genuinely unusual custom format beyond prefix and character-set variation, you may need to manually assemble the final token from this tool’s output.

Should generated tokens like this be stored anywhere, or just used immediately?

This tool doesn’t store anything — each generated token exists only in your browser session and is gone once you navigate away or refresh, by design, since a tool that persisted generated secrets would itself become a security liability. Copy and store the token in whatever secrets management system or password manager is appropriate for your actual use case immediately after generating it.

Why would I choose hex-only over including symbols and mixed case?

Hex-only tokens (using just 0-9 and a-f) are often chosen specifically because they’re guaranteed to be safely embeddable in URLs, HTTP headers, and most database column types without any escaping concerns, at the cost of needing a slightly longer token to achieve the same total randomness as a format using a larger character set.