About this tool
Tokens are generated with the Web Crypto API (crypto.getRandomValues), the browser's cryptographically secure randomness source — not Math.random().
Pick a length and character set, and copy the result. Nothing is stored or transmitted; every token exists only on your screen.
A 32-character alphanumeric token carries ~190 bits of entropy — far beyond brute-force reach.
Frequently asked questions
How random are these tokens?
They use crypto.getRandomValues — the same CSPRNG browsers use for cryptography. Suitable for secrets, unlike Math.random().
Could two tokens ever collide?
At 32 alphanumeric characters the probability is about 1 in 10⁵⁷ — effectively impossible.
What length should I use?
32 characters is a solid default for API keys; use 64 for long-lived secrets. Longer costs nothing.