How long should a secret token be?

128 bits of entropy is a common minimum for secrets and 256 bits is a comfortable choice. With 62 alphanumeric characters, each character adds about 5.95 bits, so 22 characters give about 128 bits and 43 give about 256.

How is entropy calculated?

Entropy is length x log2(size of the character set). For example, 32 hex characters give 32 x 4 = 128 bits.

Is Math.random() good enough for tokens?

No. Math.random() is not cryptographically secure. Security-sensitive tokens should come from a CSPRNG such as crypto.getRandomValues, which this tool uses.

Random Token and String Generator (Secure)

Generate cryptographically secure random tokens and strings with custom character sets locally.

About Token Generator

Generates cryptographically secure random strings using crypto.getRandomValues with rejection sampling, so every character is equally likely. You choose the length (up to 4096), which character groups to include (uppercase, lowercase, digits, symbols) or a custom character set, and whether to exclude look-alike characters such as I, l, 1, O and 0. It shows the entropy in bits and can generate up to 500 tokens at once. Generation is local, so the tokens are never sent anywhere.

Common uses

Create API keys, secrets and session tokens
Generate random passwords with a specific character set
Produce hex strings using a custom set like 0123456789abcdef
Make many unique codes for vouchers or test fixtures

FAQ

How long should a secret token be?: 128 bits of entropy is a common minimum for secrets and 256 bits is a comfortable choice. With 62 alphanumeric characters, each character adds about 5.95 bits, so 22 characters give about 128 bits and 43 give about 256.
How is entropy calculated?: Entropy is length x log2(size of the character set). For example, 32 hex characters give 32 x 4 = 128 bits.
Is Math.random() good enough for tokens?: No. Math.random() is not cryptographically secure. Security-sensitive tokens should come from a CSPRNG such as crypto.getRandomValues, which this tool uses.