Token generator

Random strings are needed everywhere in software: API keys, session secrets, password reset tokens, invite codes, test data and temporary passwords. This generator creates them with exactly the length and character set you need, using the browser's cryptographically secure random number generator.

How to use it

1. Choose which characters to include: uppercase letters, lowercase letters, numbers and symbols.
2. Set the length.
3. Generate and copy the token.

How strong is a token?

Entropy in bits = length × log2(alphabet size).

• Digits only (10 characters): 3.3 bits per character.
• Lowercase and digits (36): 5.2 bits per character.
• Upper, lower and digits (62): 5.95 bits per character. A 32-character token has about 190 bits.
• All printable symbols (about 94): 6.55 bits per character.

For secrets that protect accounts or APIs, aim for at least 128 bits of entropy, for example 22 or more alphanumeric characters.

Example

A 32-character alphanumeric token looks like q7Xr2LmN9vTb4KcZp0WfHs8JdYe1Ua6R. Every generation is different and unpredictable.

Choosing a character set

• Avoid symbols in tokens that will be placed in URLs, shell commands or config files without escaping.
• Remove look-alike characters such as 0, O, l and 1 for codes that people type by hand.
• Never use Math.random() for security tokens; it is not cryptographically secure. Use crypto.getRandomValues in browsers or crypto.randomBytes in Node.js.