Random Token Generator

Create random values for session IDs, invite codes, and verification tokens with configurable size and encoding. Supports both single and batch generation.

Entropy

Status

Runs in your browser. No input is sent to a server.

How to use

Choose bytes, format, and count, then click Generate. Add prefix/suffix if needed to match naming rules.

Notes (this tool)

  • For sensitive use, design storage policies too (hashing and expiry management).
  • Rendered length differs by encoding format. Same bytes do not mean same string length.

About this page

What does this tool do?

Generates byte sequences with cryptographic randomness (Web Crypto) and encodes them to the selected format.

Shows entropy bits per token so you can quickly judge whether length is sufficient for your use case.

Typical use cases

  • Draft reset/email verification tokens
  • Temporary IDs and one-time values for internal APIs
  • Prepare batch random strings for test data

Recommendations (practical)

  • Use base64url for URL embedding, and hex when input constraints are strict
  • For auth tokens, start around 128+ bits and always set expiration
  • Store tokens with hashing/server-side comparison and avoid plaintext persistence

What this tool does

  • Generate random bytes with chosen size (1–128)
  • Encode as hex / base64 / base64url / base32
  • Add prefix/suffix for operationally ready output

Notes

  • This tool handles generation/encoding only; signing, verification, and revocation need separate design.
  • Avoid leaving sensitive tokens in clipboard history and clear them after use.
  • Do not reuse the same token across multiple systems.

Debugging workflow (recommended)

  • Choose byte size and encoding by use case
  • Paste into destination system to verify charset constraints
  • Finalize expiry, revocation, and storage policy in the application layer

Referenced specs

  • Web Crypto API (getRandomValues)
  • RFC 4648 (Base64 / Base32)

FAQ

When should I choose base64url vs base64?

For URLs, cookies, and query strings, base64url is easier to handle. For internal storage only, base64 is usually fine.

How many bytes should I use?

It depends, but 16 bytes (128 bits) is a practical starting point for auth/reissue tokens.

References

  1. RFC 4648
  2. MDN: Crypto.getRandomValues()

These links are generated from site_map rules in recommended diagnostic order.

  1. URL Safe Random — Generate random strings using URL/filename-safe characters
  2. Password Seed Generator — Derive reproducible passwords from seed and constraints
  3. Cookie Security Audit — Audit Secure/HttpOnly/SameSite settings
  4. Random Password — Generate random passwords with length, charset, and exclusion options
  5. Mahjong Point Calculator — Calculate point movement on win from han/fu, honba, and kyotaku
  6. Mahjong All-Last Calculator — Compute ron/tsumo conditions needed to reach target rank from current scores
  7. Unix Time Converter — Convert Unix seconds/milliseconds and date-time both ways
  8. Cron Builder — Build 5-field cron and preview upcoming runs

Quick Calculators

One-screen calculators for commonly forgotten quick math

Security Operations

Generate practical passwords, tokens, and operation checklists quickly

Example

format: base64url
bytes: 24
output: 8n8xM5v0r4cQ8wKq3v4V3kVTRiYx2g8Y