Token Generator
Cryptographically secure random tokens, your rules
Output: Output
Length: Length
How Many: How many
Charsets: Character sets
Lower: Lowercase
Lower Hint: a–z
Upper: Uppercase
Upper Hint: A–Z
Digits: Digits
Digits Hint: 0–9
Symbols: Symbols
Symbols Hint: !@#$%^&*…
Custom: Custom characters
Custom Placeholder: e.g. -._~
Custom Hint: Added to the alphabet, duplicates removed
Rules: Rules
Exclude Similar: Exclude similar
Exclude Similar Hint: I l 1 O 0 o
No Repeat: No repeating chars
No Repeat Hint: Each character used at most once
Wrap: Wrap
Prefix: Prefix
Prefix Placeholder: e.g. sk_
Suffix: Suffix
Suffix Placeholder: e.g. _live
Alphabet: Alphabet:
Entropy: Entropy:
Bits: bits
Generate: Generate
Err Set: Select at least one character set
Err Min: Length must be at least 1
Err Max: Length capped at 1024
Err Count: Count must be between 1 and 100
Err Clipboard: Clipboard not available
Token: Token
Copy All: Copy all
Copied: Copied
Copy Aria: Copy token
Footnote: Generated locally in your browser using the Web Crypto API. Nothing is sent to a server.
Strength
Very Weak: Very weak
Weak: Weak
Reasonable: Reasonable
Strong: Strong
Very Strong: Very strong
About Title: About this random token generator
About
This is a free, browser-based random token generator built for developers and security-minded users who need cryptographically secure strings: API keys, secret tokens, password reset codes, session IDs, encryption keys, or just strong random passwords. Every token is generated locally in your browser using the Web Crypto API, nothing is ever sent to a server, logged, or stored.
You control everything: token length up to 1024 characters, how many tokens to generate at once (up to 100), which character sets to include (lowercase, uppercase, digits, symbols, or your own custom alphabet), whether to exclude visually similar characters like I, l, 1, O, 0, and o, and whether each character is allowed to repeat. Add a prefix like sk_ or a suffix like _live to match your existing token format.
The strength meter shows the entropy in bits, the same metric NIST and OWASP use to rate password and key strength. Anything above 128 bits is cryptographically strong for production use; 256+ bits is overkill for most things but cheap to generate. Pick the strength that fits your threat model, then copy with one click.
Faq Title: Frequently asked questions
Faq
Are these tokens cryptographically secure?
Yes. Every token uses crypto.getRandomValues() from the browser's Web Crypto API, which is a CSPRNG (cryptographically secure pseudo-random number generator). It's the same primitive used by HTTPS, password managers, and operating-system level random number generation. Math.random() is never used.
Is the generator safe for API keys and production secrets?
Yes, with one common-sense rule: do not paste the same generated token into a public URL, screenshot, or chat. Tokens are generated and shown only in your browser tab, closing the tab destroys them. For production secrets, copy directly into your secrets manager (1Password, AWS Secrets Manager, GitHub Actions secrets, Vercel env vars, etc.) and rotate periodically.
What length should I use for an API key?
32 alphanumeric characters (≈190 bits of entropy) is the modern standard for API keys and is strong enough to resist brute force essentially forever. Use 64 characters if you want headroom for very long-lived keys. For password reset tokens or short-lived session IDs, 24 characters is plenty.
What length should I use for a strong password?
16 characters with mixed case, digits and symbols gives ≈100 bits of entropy, strong enough for any account that's not protected by 2FA. For a vault master password or root account password, use 20+ characters and skip the symbols if you'll need to type it on a phone.
Why exclude similar characters like I, l, 1, O, 0?
If a human is going to read or type the token (license keys, share codes, PIN-style identifiers, recovery codes), those characters get mixed up constantly. For machine-only secrets like API keys, leave them in: more characters means more entropy.
What does no-repeat do?
It guarantees every character in the token is unique. Useful for human-readable codes where you want to avoid runs like 'AAAA', but it caps your maximum length at the size of your alphabet (e.g. 36 characters max for lowercase + digits) and reduces entropy slightly compared to allowing repeats.
Disclaimer: For information only. Tokens are generated locally in your browser using the Web Crypto API and are not stored or transmitted, but you remain responsible for how you store, share and rotate them. Not a substitute for a proper secrets manager.
Cta Label: Want secure auth that's actually yours?
Cta Title: Want a tool like this, or a full app with proper auth and secrets, built for you and ready to use?
Cta Button: Get in touch
Using the interactive tool
Open the canonical HTML page to use the calculator or generator. This Markdown alternate provides its complete explanatory content, labels, options, results guidance, FAQs, and limitations.