Toolbox101 All tools

Generators

Secure token generator

The secure token generator draws random bytes from crypto.getRandomValues, the browser's cryptographic random source, and prints them as hex (the default) or Base64URL. The default is 32 bytes, 256 bits, which is 64 hex characters; "Bytes" accepts 1 to 1,024. Developers use tokens like these for API keys in local test fixtures, CSRF values, one-time link codes and anywhere a high-entropy random string is needed. A token appears when the tool opens, and each click on "Generate New" replaces it.

Open Secure Token Gen in the app Browse all tools

How to use Secure Token Gen

  1. Open Secure Token Gen in the Toolbox101 app; a 64-character hex token is already in the Output box.
  2. Set Bytes for the length you need and pick Hex or Base64URL in Format.
  3. Click Generate New to draw again. Every value is fresh random bytes, never cached.
  4. Click Copy and paste the token into your Authorization header, environment variable or test fixture.

Worked example

Secure Token Gen gives a different result every time, so yours will differ. This is one run:

Output

2436e5948e5f83c02573e4afa1008a69065a4c0f8c620c6dfee0e4ba74827430

Frequently asked questions

What is a secure token used for?

Anywhere you need an unpredictable value of known length: API keys for development fixtures, CSRF tokens, idempotency keys and one-time codes. With 256 bits of randomness the default token is also suitable as a shared secret for HMAC signing. Treat it as secret material and rotate it as you would a password.

Hex or Base64URL?

Both encode the same random bytes. Hex is longer, two characters per byte, and is safe anywhere. Base64URL is about a third shorter, four characters per three bytes with no padding, and is safe in URLs. Pick whichever the receiving system expects: 32 bytes is 64 hex characters or 43 Base64URL characters.

Why is the default output 64 characters of hex?

The default is 32 random bytes, and each byte is written as two hexadecimal characters, so 32 bytes become exactly 64 characters. 32 bytes is 256 bits, the entropy of the whole token. Change Bytes for a different length.

How is this different from the password generator?

The password generator mixes character types so a person can type the result. This tool gives raw random bytes in hex or Base64URL, with no character-type rules. Both use the browser's cryptographic random source. Use this one for machine-to-machine secrets and the password generator for anything a person types.

Use Secure Token Gen now

Open Secure Token Gen in the app

Runs in your browser. Nothing you type is uploaded.