How to use the token generator
- Set the Length to the number of random characters you need.
- Pick a Character set such as hex, base64url or alphanumeric.
- Optionally add a Prefix like
sk_live_to identify the token type. - Choose how many tokens to Generate at once (up to 20).
- Click Generate and copy the results from the output list.
How entropy is calculated
The security of any random token generator depends on its entropy, measured in bits. Entropy equals the token length multiplied by the base-2 logarithm of the alphabet size:
entropy = length × log2(alphabet_size)
For example, a 32-character hexadecimal token uses an alphabet of 16 characters (0 through 9 and a through f). Since log2(16) is exactly 4, the entropy is 32 × 4 = 128 bits. A 128-bit token has 2128 possible combinations, which is considered secure against brute-force attacks for most applications.
Character sets and their properties
Different use cases call for different alphabets. Here is a reference table of the character sets available in this tool:
| Charset | Alphabet | Size | Bits per char | 32-char entropy |
|---|---|---|---|---|
| Hex | 0-9, a-f | 16 | 4.00 | 128.0 bits |
| Base64 URL-safe | A-Z, a-z, 0-9, -, _ | 64 | 6.00 | 192.0 bits |
| Alphanumeric | A-Z, a-z, 0-9 | 62 | 5.95 | 190.5 bits |
| Numeric | 0-9 | 10 | 3.32 | 106.3 bits |
| Base32 | A-Z, 2-7 | 32 | 5.00 | 160.0 bits |
Hex is common for database identifiers and color codes. Base64 URL-safe is ideal for web tokens because it avoids padding characters that break URLs. Alphanumeric gives slightly less entropy per character than base64 but avoids symbols that might cause issues in certain legacy systems.
Rejection sampling and modulo bias
A naive approach to generating random characters is to take a random byte and compute byte % alphabet_size. This introduces modulo bias: when 256 is not evenly divisible by the alphabet size, some characters appear more often than others. For instance, with a 62-character alphanumeric alphabet, 256 / 62 leaves a remainder of 8, meaning the first 8 characters are slightly over-represented.
This secure token generator avoids that problem using rejection sampling. It generates a random byte and discards it if it falls outside the largest multiple of the alphabet size that fits within 256. Only accepted bytes are mapped to characters, guaranteeing a perfectly uniform distribution across every position in the token.
Practical use cases
Random tokens serve many purposes in software development. An api key generator pattern typically combines a recognizable prefix with a high-entropy random string, such as sk_live_a3f..., making it easy to identify the key type in logs without exposing the secret itself.
Other common applications include:
- Session identifiers for web applications
- Password reset tokens sent via email
- CSRF tokens embedded in HTML forms
- OAuth state parameters to prevent replay attacks
- Opaque bearer tokens for API authentication
For structured identifiers that embed timestamps, consider pairing this tool with a UUID generator or a ULID generator. If you need to verify checksums on existing identifiers, tools like the credit card validator handle Luhn checks.
Choosing the right token length
The required length depends on your threat model. For short-lived CSRF tokens, 128 bits of entropy (32 hex characters) is generally sufficient. For long-lived API keys or secrets protecting sensitive data, aim for at least 256 bits, which means 64 hex characters or 43 base64url characters.
Longer tokens are harder to guess but take up more space in databases and URLs. Balance security requirements against storage and transmission constraints. Avoid using the numeric charset for high-security tokens unless you significantly increase the length, since each digit contributes only about 3.32 bits of entropy.
Worked examples
| Example | Input | Result |
|---|---|---|
| 32-char hex token | Length: 32; Character set: hex; Count: 1 | 14806fb5d60d270f42cbf8cf6ac61956 |
| API key with prefix | Length: 40; Character set: base64url; Prefix: sk_live_; Count: 1 | sk_live_D5_SBewfL22BSyBQydK6032odz4AMpSEEasPqSkm |
| Five numeric codes | Length: 6; Character set: numeric; Count: 5 | 971287, 669492, 437220, 320341, 441810 |
| Base32 secret | Length: 16; Character set: base32; Count: 1 | 7O52VAOSXDYA7GBV |
FAQ
Is this token generator cryptographically secure?
Yes. It uses the Web Crypto API (crypto.getRandomValues) as its randomness source, combined with rejection sampling to eliminate modulo bias. This produces uniformly distributed, unpredictable tokens suitable for security-sensitive applications.
Does the prefix count toward the token length?
No. The length field controls only the number of random characters. The prefix is prepended after generation, so a length of 32 with a prefix of "sk_" produces a 35-character string.
What is the difference between base64url and standard base64?
Standard base64 uses + and / and adds = padding, which can break URLs and file paths. Base64url replaces those with - and _ and omits padding, making it safe for query strings, headers and filenames.
Are my generated tokens stored or transmitted anywhere?
No. The entire process runs locally in your browser. No tokens, prefixes or settings are sent to any server, logged or saved.
Can I use this as an API key generator?
Absolutely. Set the charset to base64url or hex, choose an appropriate length (at least 32 characters), add your project prefix and generate. The result follows the same format used by major payment and cloud providers.
Why use rejection sampling instead of modulo?
Modulo arithmetic creates a slight bias toward certain characters when the random range is not a perfect multiple of the alphabet size. Rejection sampling discards out-of-range values, ensuring every character has an exactly equal probability of appearing.