Random Token Generator

Generate random tokens in the browser with Web Crypto, choose bytes and format, and copy only when you decide to.

Generate a random token

Create one token or a bounded batch from random bytes without saving generated values.

Settings

Choose the byte count, output encoding, and number of tokens.

Bytes per token

More bytes mean more random bits; encoding changes only the displayed text.

Format

Hex uses two characters per byte. Base64URL is compact, URL-safe, and omits trailing = characters.

Quantity

Enter a whole number from 1 to 20.

The link restores bytes, format, and quantity with an empty list. The recipient must generate fresh values.

Tokens and results never enter the shared link. Do not manually place secrets in a URL.

Privacy and security boundary

Generation runs in browser memory with crypto.getRandomValues. This tool does not send generated values.

Extensions, same-origin scripts, a compromised device, and clipboard software may still access visible or copied values. The site continues to load normal resources over the network.

How to read the output

Bytes and bits

Each byte contains eight bits. That makes 16 bytes equal to 128 theoretical random bits and 32 bytes equal to 256.

Encoding is not encryption

Hex and Base64URL represent the same bytes with different alphabets. Changing format does not add randomness or hide the value.

Random string, not an issued credential

This page does not create sessions, JWTs, OAuth tokens, bank access, expiry, revocation, or authorization for any service.

Sources and references

W3C Web Cryptography API

Defines crypto.getRandomValues for filling integer arrays with cryptographically random values.

RFC 4648

Defines the Base64, Base64URL, and hexadecimal encodings used to represent the bytes.

OWASP Session Management Cheat Sheet

Recommends framework-issued session identifiers and treats generation, lifecycle, and storage as separate responsibilities.

UUID generator Password generator Base64 converter JWT Decoder Hash generator

Quick questions

What does this generator create?

It creates opaque strings from browser-generated random bytes for tests, examples, and systems that explicitly accept externally generated secrets.

Does the token grant OAuth, banking, API, or session access?

No. A random string has no service permissions. Real credentials must be issued and managed by the responsible system.

Does hex or Base64URL encrypt the token?

No. Both options only encode the same bytes. Base64URL uses fewer characters; hex is often easier to inspect.

Why are byte and character counts different?

Bytes measure random data. The representation uses 2 hex characters per byte or about 4 Base64URL characters for every 3 bytes.

Why might Web Crypto be unavailable?

The tool requires a secure context and crypto.getRandomValues. Update the browser and open the page over HTTPS or localhost. There is no insecure fallback.

Are tokens stored or sent?

The tool keeps values only in memory and on screen unless you copy them. It does not send, save, include them in telemetry, or put them in the URL.

What does Share include?

Only nondefault byte, format, and quantity settings. The recipient opens an empty list and must generate fresh tokens.

Can I use the result as a production secret?

First confirm the target system's contract. For authentication, generate and store secrets in a trusted backend or framework with expiry, rotation, revocation, and controlled access.

For real authentication, prefer the system's trusted backend or framework and appropriate secret storage. Clearing this page does not securely erase device memory or the operating-system clipboard.

About the random token generator

The generator uses crypto.getRandomValues in the browser to create 16 to 64 random bytes per token and encode each batch as lowercase hexadecimal or unpadded Base64URL. Values appear only after an explicit action and are not sent or persisted by the tool.

How to generate a random token

Choose bytes, format, and quantity, select Generate, and copy one value or the batch. Changing a setting clears earlier results. Share preserves settings only and never the tokens.

Random Token Generator

Settings

Share settings

Privacy and security boundary

How to read the output

Bytes and bits

Encoding is not encryption

Random string, not an issued credential

Sources and references

Related tools

Quick questions

What does this generator create?

Does the token grant OAuth, banking, API, or session access?

Does hex or Base64URL encrypt the token?

Why are byte and character counts different?

Why might Web Crypto be unavailable?

Are tokens stored or sent?

What does Share include?

Can I use the result as a production secret?

About the random token generator

How to generate a random token

Settings

Share settings

Privacy and security boundary

How to read the output

Bytes and bits

Encoding is not encryption

Random string, not an issued credential

Sources and references

Related tools

Quick questions

What does this generator create?

Does the token grant OAuth, banking, API, or session access?

Does hex or Base64URL encrypt the token?

Why are byte and character counts different?

Why might Web Crypto be unavailable?

Are tokens stored or sent?

What does Share include?

Can I use the result as a production secret?