Random Token Generator

Generate cryptographically secure random tokens/keys for development and testing.

Random Token Generator makes this small but important security step practical to actually do. Random Token Generator lets you do this quickly and safely without relying on anything else. The whole process happens locally in your browser; nothing is sent to a server.

Step-by-step

Enter a value in Length. The number of characters in the output can depend on the format, so compare the result with the length your system expects.
Pick a format from the Format menu: hex, base64 or alphanumeric.
Click Run and copy the token from the result area.
Store it in an environment file (.env) or your secrets manager rather than pasting it directly into source code.

Which format should you pick?

hex uses only the digits 0-9 and the letters a-f, which makes it easy to read in logs, database IDs and test keys. base64 packs more randomness into the same length, but it can include +, / and =, which cause trouble in URLs and file names. alphanumeric sticks to letters and digits, so it drops into URL parameters, invite codes and config files without any escaping.

Example

You're setting up a web app locally and need a secret for signing session cookies. Generate a long alphanumeric token and add it to your .env file as SESSION_SECRET. Generate a separate token for staging and another for production, so a key leaked from a test environment can't touch the live system.

How is a random token produced?

The tool lets you choose a length from 8 to 256 characters (hex, base64 and alphanumeric formats are available). The alphanumeric format leaves out easily confused characters such as 0, O, 1, l and I; the base64 output uses - and _ instead of + and / so it is safe in URLs. For secure use the randomness must be unpredictable, so using the browser's secure random number generator is far more appropriate than predictable sources such as dates or counters.

Practical tips

A short token is fine for temporary tests; for secrets like API keys and sessions choose a long one.
Put the token in your password manager or environment variables as soon as you generate it; do not leave it in chat or email history.
Use a separate token for each environment (development, test, production).

Common mistakes

Hard-coding the token and pushing it to a public repository.
Using an old token for a long time without rotating it.
Using a generated token as a user's password when users should choose their own.

Things to keep in mind

Keep .env files out of Git by listing them in .gitignore. A key committed to a repository stays in its history even after you delete it.
If you suspect a token has leaked, rotate it: issue a new one and revoke the old.
Don't paste tokens into screenshots, chat messages or bug reports.
If a person needs to remember it, use a password generator instead. Tokens are meant for machines talking to machines.