--- title: "Random Token Generator · API Key & Secure Password Generator" canonical: "https://laurensdeleeuw.be/en/tools/token-generator" markdown_alternate: "https://laurensdeleeuw.be/en/tools/token-generator.md" language: "en-BE" content_type: "interactive-tool" robots: "noindex, follow" --- # Token Generator Cryptographically secure random tokens, your rules - **Output:** Output - **Length:** Length - **How Many:** How many - **Charsets:** Character sets - **Lower:** Lowercase - **Lower Hint:** a–z - **Upper:** Uppercase - **Upper Hint:** A–Z - **Digits:** Digits - **Digits Hint:** 0–9 - **Symbols:** Symbols - **Symbols Hint:** !@#$%^&*… - **Custom:** Custom characters - **Custom Placeholder:** e.g. -._~ - **Custom Hint:** Added to the alphabet, duplicates removed - **Rules:** Rules - **Exclude Similar:** Exclude similar - **Exclude Similar Hint:** I l 1 O 0 o - **No Repeat:** No repeating chars - **No Repeat Hint:** Each character used at most once - **Wrap:** Wrap - **Prefix:** Prefix - **Prefix Placeholder:** e.g. sk_ - **Suffix:** Suffix - **Suffix Placeholder:** e.g. _live - **Alphabet:** Alphabet: - **Entropy:** Entropy: - **Bits:** bits - **Generate:** Generate - **Err Set:** Select at least one character set - **Err Min:** Length must be at least 1 - **Err Max:** Length capped at 1024 - **Err Count:** Count must be between 1 and 100 - **Err Clipboard:** Clipboard not available - **Token:** Token - **Copy All:** Copy all - **Copied:** Copied - **Copy Aria:** Copy token - **Footnote:** Generated locally in your browser using the Web Crypto API. Nothing is sent to a server. ## Strength - **Very Weak:** Very weak - **Weak:** Weak - **Reasonable:** Reasonable - **Strong:** Strong - **Very Strong:** Very strong - **About Title:** About this random token generator ## About - This is a free, browser-based random token generator built for developers and security-minded users who need cryptographically secure strings: API keys, secret tokens, password reset codes, session IDs, encryption keys, or just strong random passwords. Every token is generated locally in your browser using the Web Crypto API, nothing is ever sent to a server, logged, or stored. - You control everything: token length up to 1024 characters, how many tokens to generate at once (up to 100), which character sets to include (lowercase, uppercase, digits, symbols, or your own custom alphabet), whether to exclude visually similar characters like I, l, 1, O, 0, and o, and whether each character is allowed to repeat. Add a prefix like sk_ or a suffix like _live to match your existing token format. - The strength meter shows the entropy in bits, the same metric NIST and OWASP use to rate password and key strength. Anything above 128 bits is cryptographically strong for production use; 256+ bits is overkill for most things but cheap to generate. Pick the strength that fits your threat model, then copy with one click. - **Faq Title:** Frequently asked questions ## Faq ### Are these tokens cryptographically secure? Yes. Every token uses crypto.getRandomValues() from the browser's Web Crypto API, which is a CSPRNG (cryptographically secure pseudo-random number generator). It's the same primitive used by HTTPS, password managers, and operating-system level random number generation. Math.random() is never used. ### Is the generator safe for API keys and production secrets? Yes, with one common-sense rule: do not paste the same generated token into a public URL, screenshot, or chat. Tokens are generated and shown only in your browser tab, closing the tab destroys them. For production secrets, copy directly into your secrets manager (1Password, AWS Secrets Manager, GitHub Actions secrets, Vercel env vars, etc.) and rotate periodically. ### What length should I use for an API key? 32 alphanumeric characters (≈190 bits of entropy) is the modern standard for API keys and is strong enough to resist brute force essentially forever. Use 64 characters if you want headroom for very long-lived keys. For password reset tokens or short-lived session IDs, 24 characters is plenty. ### What length should I use for a strong password? 16 characters with mixed case, digits and symbols gives ≈100 bits of entropy, strong enough for any account that's not protected by 2FA. For a vault master password or root account password, use 20+ characters and skip the symbols if you'll need to type it on a phone. ### Why exclude similar characters like I, l, 1, O, 0? If a human is going to read or type the token (license keys, share codes, PIN-style identifiers, recovery codes), those characters get mixed up constantly. For machine-only secrets like API keys, leave them in: more characters means more entropy. ### What does no-repeat do? It guarantees every character in the token is unique. Useful for human-readable codes where you want to avoid runs like 'AAAA', but it caps your maximum length at the size of your alphabet (e.g. 36 characters max for lowercase + digits) and reduces entropy slightly compared to allowing repeats. - **Disclaimer:** For information only. Tokens are generated locally in your browser using the Web Crypto API and are not stored or transmitted, but you remain responsible for how you store, share and rotate them. Not a substitute for a proper secrets manager. - **Cta Label:** Want secure auth that's actually yours? - **Cta Title:** Want a tool like this, or a full app with proper auth and secrets, built for you and ready to use? - **Cta Button:** Get in touch ## Using the interactive tool Open the [canonical HTML page](https://laurensdeleeuw.be/en/tools/token-generator) to use the calculator or generator. This Markdown alternate provides its complete explanatory content, labels, options, results guidance, FAQs, and limitations.