How long should an API key or session token be?

For session tokens and CSRF tokens, 128 bits (16 bytes, 32 hex chars) provides sufficient entropy. For API keys meant to be remembered or typed, 32 bytes (64 hex chars) is a safe standard used by Stripe, GitHub, and others.

What is the difference between a token in hex vs Base64?

Both represent the same random bytes. Hex uses 2 characters per byte (0–9, a–f), making a 16-byte token 32 characters. Base64 uses ~1.33 characters per byte, so 16 bytes becomes 24 characters. Base64 is more compact.

Are these tokens suitable for password reset links?

Yes. A 32-byte cryptographically secure token in URL-safe Base64 format is appropriate for password reset links. Store a hash of the token in your database and expire it after 1 hour.

Дом ИнструментыRandom Token Generator

Генератор случайных токенов

Name: Генератор случайных токенов
Rating: 4.8 (120 reviews)
Author: DailyDevTools

Генерируйте безопасные случайные токены

Длина32 characters

Включить цифры

Включить символы

Use these tools directly in Chrome

Install the DailyDevTools extension — access all tools from your browser toolbar

Add to Chrome

What is Random Token Generator?

Secure random tokens are used for API keys, session identifiers, password reset links, CSRF tokens, and invite codes. DailyDevTools' Token Generator creates cryptographically secure random tokens in multiple formats — hex, Base64, alphanumeric, or custom character sets — at any length, using the Web Crypto API for true randomness. All generation happens locally in your browser.

How to use Random Token Generator

1Set the desired token length in bytes or characters
2Choose the output format: hexadecimal, Base64, Base64 URL-safe, or alphanumeric
3Click Generate to create a new token — or generate multiple tokens at once with Bulk mode
4Click Copy to copy the token to your clipboard

Frequently asked questions

Comments

Вам также может понравиться

Изучите другие популярные инструменты разработчика

Хэш-генератор

Генерация хэшей MD5, SHA-1, SHA-256.

Генератор паролей

Создавайте безопасные случайные пароли

Локальный менеджер паролей

Безопасное хранение паролей локально с помощью шифрования

Инструменты шифрования

Кодер/декодер ROT13 и Caesar Cipher