Random Token Generator

How to use the random token generator

1. Choose a length and alphabet.
2. Check the entropy is at least 128 bits for a real secret.
3. Generate and copy.

About this tool

Tokens come from the browser's cryptographic random source, not from `Math.random`. That distinction is the entire point: `Math.random` is a predictable generator, and secrets built on it have been recovered in practice.

Modulo bias is handled too. Taking a random byte modulo the alphabet length makes the earliest characters slightly more likely whenever 256 is not a multiple of that length — a small skew, but a real one, and it is the sort of subtle flaw that survives in code for years. Bytes falling in the biased tail are discarded and redrawn instead.

The entropy figure is the number that actually matters. It counts how many bits of unpredictability the token carries: a 32-character hex token is 128 bits, and 128 bits is beyond brute force for any conceivable attacker. Below about 80 bits, a token is not a secret.

Base58 is offered because it omits the characters people confuse — zero and capital O, one and lowercase l — which matters when a token might be read aloud or typed by hand. URL-safe is the right default for anything that goes in a link.

Nothing is transmitted, which is worth stating for a tool whose entire output is meant to be secret.

Common uses

• Creating an API key or session secret.
• Generating a hard-to-guess URL for sharing.
• Producing test credentials that are not guessable.

Frequently asked questions

How long should a token be?

Aim for at least 128 bits of entropy — 32 hex characters, or 22 URL-safe characters. The entropy figure updates as you change the settings.

Is this actually random?

It uses the browser's cryptographic random source rather than Math.random, and rejects values that would introduce modulo bias.

Are generated tokens sent anywhere?

No. They are generated in the page and never transmitted, which matters rather a lot for something intended to be secret.