Random Token Generator
Create random values for session IDs, invite codes, and verification tokens with configurable size and encoding. Supports both single and batch generation.
Entropy
Status
Runs in your browser. No input is sent to a server.
How to use
Choose bytes, format, and count, then click Generate. Add prefix/suffix if needed to match naming rules.
Notes (this tool)
- For sensitive use, design storage policies too (hashing and expiry management).
- Rendered length differs by encoding format. Same bytes do not mean same string length.
About this page
What does this tool do?
Generates byte sequences with cryptographic randomness (Web Crypto) and encodes them to the selected format.
Shows entropy bits per token so you can quickly judge whether length is sufficient for your use case.
Typical use cases
- Draft reset/email verification tokens
- Temporary IDs and one-time values for internal APIs
- Prepare batch random strings for test data
Recommendations (practical)
- Use base64url for URL embedding, and hex when input constraints are strict
- For auth tokens, start around 128+ bits and always set expiration
- Store tokens with hashing/server-side comparison and avoid plaintext persistence
What this tool does
- Generate random bytes with chosen size (1–128)
- Encode as hex / base64 / base64url / base32
- Add prefix/suffix for operationally ready output
Notes
- This tool handles generation/encoding only; signing, verification, and revocation need separate design.
- Avoid leaving sensitive tokens in clipboard history and clear them after use.
- Do not reuse the same token across multiple systems.
Debugging workflow (recommended)
- Choose byte size and encoding by use case
- Paste into destination system to verify charset constraints
- Finalize expiry, revocation, and storage policy in the application layer
Referenced specs
- Web Crypto API (getRandomValues)
- RFC 4648 (Base64 / Base32)
FAQ
When should I choose base64url vs base64?
For URLs, cookies, and query strings, base64url is easier to handle. For internal storage only, base64 is usually fine.
How many bytes should I use?
It depends, but 16 bytes (128 bits) is a practical starting point for auth/reissue tokens.
References
Next to view (diagnostic order)
These links are generated from site_map rules in recommended diagnostic order.
- URL Safe Random — Generate random strings using URL/filename-safe characters
- Password Seed Generator — Derive reproducible passwords from seed and constraints
- Cookie Security Audit — Audit Secure/HttpOnly/SameSite settings
- Random Password — Generate random passwords with length, charset, and exclusion options
- Mahjong Point Calculator — Calculate point movement on win from han/fu, honba, and kyotaku
- Mahjong All-Last Calculator — Compute ron/tsumo conditions needed to reach target rank from current scores
- Unix Time Converter — Convert Unix seconds/milliseconds and date-time both ways
- Cron Builder — Build 5-field cron and preview upcoming runs
Same-theme links
Quick Calculators
One-screen calculators for commonly forgotten quick math
- Mahjong Point Calculator — Calculate point movement on win from han/fu, honba, and kyotaku
- Mahjong All-Last Calculator — Compute ron/tsumo conditions needed to reach target rank from current scores
- Unix Time Converter — Convert Unix seconds/milliseconds and date-time both ways
- Cron Builder — Build 5-field cron and preview upcoming runs
- Text Counter — Count characters including newline and full/half-width views
- Regex Tester — Test regex matching, extraction, and replacement
- Regex Cheat Generator — Generate regex patterns from practical templates
- SQL WHERE Builder — Build WHERE clauses and bind params from condition rows
- SQL UPSERT Builder — Generate dialect-specific UPSERT SQL and bind values
Security Operations
Generate practical passwords, tokens, and operation checklists quickly
- Random Password — Generate random passwords with length, charset, and exclusion options
- Password Seed Generator — Derive reproducible passwords from seed and constraints
- URL Safe Random — Generate random strings using URL/filename-safe characters
- Password Policy Generator — Create policy text and validation regex from requirements
- Token Format Checker — Infer JWT/UUID/Hex/Base64URL candidates from input text
- .env Diff Checker — Compare .env added/removed/changed keys
- Hash / HMAC Generator — Generate SHA-family hashes and HMAC values
- htpasswd Generator — Generate username:hash lines for .htpasswd
- WordPress Salt Generator — Generate 8 wp-config.php secret key constants
- WP Security Checklist Builder — Generate security operation checklists for WordPress
Example
format: base64url bytes: 24 output: 8n8xM5v0r4cQ8wKq3v4V3kVTRiYx2g8Y