Random Token Generator - API Keys, Secrets & UUIDs

Loading tool…

Secure Random Token Generator

Session IDs, API keys, webhook secrets and password reset links all depend on values that nobody can guess. QodeCat Token Generator creates them with the browser's cryptographic random number generator and shows exactly how much entropy each token carries.

Formats: Hex, Base64, Base64URL, alphanumeric, UUID v4 or your own characters.
Prefixes: add a label such as sk_live_ to make keys easy to identify.
Bulk: generate up to 50 tokens at once and copy them all.
Entropy meter: see the strength in bits before you use a token.

Why use this tool?

No weak randomness

Every token comes from crypto.getRandomValues, never Math.random. For alphanumeric and custom character sets we use rejection sampling, so each character is exactly as likely as any other and no bias creeps in.

Generated locally

Tokens are created on your device and are never sent to or stored on a server, so you can paste them straight into your configuration.

Frequently Asked Questions

Q. How many bits of entropy do I need?

128 bits or more is the usual recommendation for secrets and API keys. That is 16 random bytes, 32 hex characters or about 22 alphanumeric characters. Below 64 bits a token can be guessed with enough effort.

Q. Which format should I choose?

Hex is the most portable. Base64URL is shorter and safe in URLs and headers. Alphanumeric avoids symbols entirely, and UUID v4 fits databases that expect a UUID column.

Q. Does the prefix make a token more secure?

No. A prefix is fixed text that helps people and secret scanners recognize the key. The entropy shown counts only the random part.