Secure Token Generator
Generate cryptographically secure random tokens (alphanumeric, hex or base64) in your browser. Ideal for API keys, secrets, passwords and unique IDs.
Thirty-two random bytes in three encodings
You need an API key or a session secret, and the temptation is Math.random, a recycled UUID or mashing the keyboard. This page pulls 32 bytes from the browser's cryptographic generator, crypto.getRandomValues, and prints them in three representations at once. One button, one output block, no configuration fields at all.
The detail people miss: those three lines are not three tokens. They are the same 32 bytes written differently — 64 hex characters, one base64 line with the equals padding stripped, and 32 alphanumeric characters. Pick one and ignore the rest. There is no way to request another length or another character set; the block is recomputed when the page loads and on every click of the generate button.
Two concrete caveats. The line labelled base64url is really standard base64 with padding removed: the + and / characters are still there and were never swapped for - and _, so check it before dropping the value into a URL or a filename. The alphanumeric line uses byte modulo 62, which slightly favours the first eight symbols of the alphabet; harmless in a 32-character token, but do not copy that trick as a general random source. There is no copy button either, so select and copy by hand.
Frequently asked questions
Are the three lines independent tokens?
Can I choose the token length?
Is it safe to generate a production secret here?
Related Tools
JWT Builder (HS256)
Build a JWT by filling in header, payload and secret. HS256 signature computed in the browser via SubtleCrypto.
Secure CSP Nonce Generator
Generate a 128-bit base64 random nonce for Content-Security-Policy with sample header and <script nonce> attribute.
Cookie __Secure-/__Host- Prefix Validator
Validate Set-Cookie headers against __Secure- and __Host- prefix rules from RFC 6265bis (Secure, Domain, Path).
Source Code Secret Scanner
Finds API keys, tokens, passwords and private keys pasted from code or .env files, by known pattern and by high entropy.
Bcrypt Hash Generator
Generate secure bcrypt hashes from passwords and verify whether a password matches an existing bcrypt hash.
Password Policy Batch Auditor
Tests a list of passwords against the policy you define, showing which fail, which rules they break and the equivalent regex.