How long should a token be?

At least 32 hexadecimal characters for anything acting as a credential, which gives 128 bits of entropy. Short tokens are guessable — an 8-character token is weak enough to brute-force.

Are these tokens safe to use in production?

They are generated with the browser's random number generator, which is suitable for most purposes. For high-value production secrets, generate them on the server with a cryptographically secure generator so they never exist in a browser at all.

Should I store tokens in plain text?

No. Store a hash of the token, exactly as you would a password. If your database is exposed, hashed tokens cannot be used directly by an attacker.

Key Generators

Random Token Generator

Generates random tokens of a length and character set you choose. Hexadecimal is the usual default for API keys, alphanumeric packs more entropy into fewer characters, and numeric suits verification codes.

Free, no signupRuns entirely in your browser

Input

Character Length

Encoding Format

Result

4a521eb50eb7fd9ed2d881ab6c250c08

About

What the Random Token Generator does

Length is what determines security, and the relationship is exponential. Each extra hexadecimal character multiplies the possible values by sixteen, so a 32-character hex token has 128 bits of entropy — comfortably beyond brute force. Anything acting as a credential should be at least 32 characters.

How it works

Using the Random Token Generator

1Choose the token length, from 8 to 128 characters.
2Pick a format: hexadecimal, alphanumeric or numeric.
3Characters are drawn at random from that set.
4The token is assembled to your specified length.
5Copy it for use.

Use cases

What people use it for

Creating an API key for a new integration
Generating a session or CSRF token
Producing a short numeric verification code
Creating a random secret for a config file

FAQ

Frequently asked questions

6 related

Related tools

All tools →

Key Generators

Random Data

Generate lists of test data like names, numbers, or emails.

Runs in your browser

Key Generators

UUID / GUID Generator

Generate v4 RFC4122 compliant UUIDs instantly.

Runs in your browser

Key Generators

PIN Generator

Create random numerical PIN access codes.

Runs in your browser

Key Generators

Password Strength Meter

Analyze strength, entropy, and complexity metrics for a password.

Runs in your browser

Key Generators

WEP/WPA Key Generator

Generate highly secure passcode keys for WEP, WPA, and WPA2 wireless router protocols.

Runs in your browser

Key Generators

Mock User Generator

Compile synthetic profile cards with names, emails, username hashes, and contact data.

Runs in your browser