KitJade
Developer ToolsRuns in your browserNew

Secure Token Generator

Cryptographically random API keys and secrets.

Use the Secure Token Generator tool

Runs in your browserUpdated Report a problem

What this secure token generator does

A predictable token is a security bug. This generator draws every character from crypto.getRandomValues, discards values that would bias the result, and builds tokens only from the sets you enable.

Tokens are produced locally and are never transmitted. Nothing is logged, and once you close the page the value exists only where you copied it.

Why use it

  • Mint API keys and webhook secrets that are not guessable.
  • Create test fixtures with the same shape as production tokens.
  • Avoid Math.random, which is fine for dice rolls and unacceptable for credentials.

How to use it

  1. 1Choose a length of at least 32 characters for anything security-sensitive.
  2. 2Select character sets, and optionally avoid look-alike characters such as 0/O and 1/l.
  3. 3Add a prefix such as sk_ for readability, then copy or download the value.

Worked examples

API key

Input

length 48 · letters, digits, symbols · prefix sk_

Output

sk_ followed by 48 cryptographically random characters, shown once for copying.

Grouped recovery code

Input

length 24 · letters and digits · no ambiguous characters · groups of 4

Output

Six hyphen-separated groups that are easy to read aloud and still high entropy.

Common mistakes

  • Pasting the token into chat, tickets or screenshots where it outlives the conversation.
  • Committing a generated key to a public repository instead of an environment variable.
  • Reusing one token for multiple services, so rotating it breaks everything at once.

Frequently asked questions

How random are these tokens?
They come from crypto.getRandomValues, the browser's cryptographic source, with a rejection step that removes modulo bias. They are not derived from Math.random.
How long should a token be?
Use at least 128 bits of entropy, which is roughly 22 characters from a mixed alphabet or 32 characters from letters and digits. 32–48 characters is a practical default.
Should I avoid ambiguous characters?
Yes for anything a human retypes, such as recovery codes. For machine-read API keys the extra alphabet is harmless and slightly increases entropy.
Are generated tokens stored for me?
No. Nothing is saved in the page or on a server. Download or copy the token before you navigate away.

Related tools

All tools

Password Generator

Cryptographically secure passwords with entropy scoring.

Runs locally

UUID Generator

Bulk random UUID v4 generation with format options.

Runs locally

Password Strength Checker

Estimate password strength without sending it anywhere.

Runs locallyNew

JSON Formatter

Beautify or minify JSON, with precise error positions.

Runs locally