Skip to main content
Bethemesh
Security & privacy

Secure token generator

Create up to 20 random tokens at once for API keys, webhook secrets or session tokens, in hex, Base64 or Base64URL, with a prefix such as sk_live_ and the entropy shown. Generated locally.

  • Clipboard

Embed this widget

Customize the result, check the live preview, then copy the code.

Preview

Embed code type

Code to copy

Responsive and automatically resized by Bethemesh.

Generated tokens

Was this tool useful?

How does this tool work?

This generator produces cryptographically secure random tokens from 8 to 256 bytes, up to 20 at a time, in hex, Base64 or Base64URL. It is for developers and administrators who need an API key, a webhook secret, a reset token or a signing key without opening a terminal.

The bytes come from crypto.getRandomValues, the browser's cryptographic random generator seeded by the operating system, not from Math.random, which is predictable. The entropy shown is simply the number of bytes times 8: the default 32 bytes give 256 bits, or 2^256 possible values, far beyond what any brute-force attack can cover. For an authentication token, 128 bits (16 bytes) is a reasonable floor and 256 bits a comfortable choice for an API key or an HMAC secret.

Encoding does not change security, only the length and the characters used. The same 32 bytes give 64 characters in hex, 44 in Base64 with the trailing "=", and 43 in Base64URL (RFC 4648, section 5), which replaces "+" and "/" with "-" and "_" and drops padding so the token can appear as-is in a URL, an HTTP header or a file name. The optional prefix, such as sk_live_, is added in front of the token without counting toward entropy: it identifies the key type at a glance and helps secret scanners, such as GitHub's, spot a leak.

How to use this tool

  1. Set the size and format

    Choose the number of bytes (8 to 256, 32 by default) and the output format: hex, Base64 or Base64URL. The matching entropy in bits is displayed.

  2. Add a prefix and a count

    Enter a prefix such as sk_live_ if needed and set how many tokens to generate, from 1 to 20.

  3. Generate and copy

    Run the generation: each token appears in the list, ready to copy into your configuration or secrets manager.

Use cases

Issue an API key for your service

Generate a 32-byte Base64URL key with a prefix such as myapp_live_, show it to the customer once and keep only its SHA-256 hash on the server.

Set a webhook secret

GitHub, Stripe and Shopify sign their webhooks with a shared secret: generate one in hex, paste it into the provider's settings and into your app to verify the HMAC signature.

Fill the secrets of a .env file

Generate several values at once for SESSION_SECRET, APP_KEY or JWT_SECRET to set up a development or staging environment with distinct secrets.

Tips and best practices

  • For a token placed in a URL or query parameter, choose Base64URL: the "+", "/" and "=" characters of standard Base64 get altered or misread in URLs.
  • Do not store API keys in clear text: keep their SHA-256 hash in the database and compare the hash on each request. For a 256-bit random token, a fast hash is enough, unlike a password.
  • A prefix does not make a token stronger: if you must respect a maximum length, shorten the prefix rather than the number of random bytes.

Frequently asked questions

How long should an API key be?

Aim for at least 128 bits of entropy, which is 16 bytes, and preferably 256 bits, which is 32 bytes, the default. That gives 43 characters in Base64URL or 64 in hex. Beyond that, the security gain is negligible and the key just gets bulkier.

Hex, Base64 or Base64URL: which should I choose?

All three represent the same bytes and offer the same security. Hex is the most readable and compatible, Base64 is more compact, and Base64URL is just as compact while staying safe in URLs, headers and file names. Follow the format expected by the service or library that will consume the token.

Is crypto.getRandomValues really secure?

Yes, it is the cryptographic random generator exposed by the Web Crypto API, seeded by the operating system, like /dev/urandom or os.urandom. It is suitable for generating keys and tokens. Math.random, by contrast, is not designed for security and its output can be predicted.

What is a prefix like sk_live_ for?

A prefix tells what kind of key it is, for example secret or publishable, live or test, without revealing its value. It helps support and lets secret-detection tools recognize a key exposed in a Git repository. Stripe (sk_live_) and GitHub (ghp_) use prefixes for that reason.

What is the difference between a random token and a UUID?

A UUID v4 contains only 122 random bits and is primarily a unique identifier; some versions, such as v1 or v7, even include a predictable timestamp. For a secret, a random 32-byte token offers 256 bits of entropy and reveals nothing. Use a UUID to identify and a token to authenticate.

Are the generated tokens stored anywhere?

No: they are created in your browser and only exist on the page until you copy them. No token is transmitted or logged. Copy them straight into your secrets manager and close the page when you are done.

Related tools

Keep going with these tools

Tools similar or complementary to this one.

Works well with

Password generator

Generate strong random passwords from 8 to 128 characters, with the entropy shown.

Security & privacyFeaturedUse this tool

OAuth PKCE Generator

Generate a PKCE code_verifier, its S256 code_challenge and a state for your OAuth authorization request.

Security & privacyNewUse this tool

HMAC Generator and Verifier

Compute an HMAC-SHA-1, SHA-256, SHA-384 or SHA-512 in hex or Base64 and verify a webhook signature.

Security & privacyNewUse this tool

Read next

TutorialBest practicesBeginner

How to securely redact a PDF before sharing it

Learn why covering text is not enough, how secure PDF redaction removes sensitive information and why sanitization matters before sharing.

10 September 20262 min