Skip to main content
NeatUtility

Random Token & Key Generator

Security & HashingMemory Only100% Client-Side
Ready

Configuration & Options

Number of characters for each generated token or key.
Format or character pool used for cryptographically secure random generation.How many tokens to generate in batch (1 to 100).

Convert hex or alphanumeric letters to uppercase.

Read-only
0 lines0 chars
0 B
About this tool, examples & FAQ

Generate cryptographically secure random tokens, secrets, API keys, session tokens, and passwords in your browser using high-entropy Web Cryptography (crypto.getRandomValues).

Key facts

Verified capabilities and limits of this utility
Entropy sourceCryptographically secure Web Cryptography (crypto.getRandomValues)
Supported formatsHexadecimal, Base64, Base64URL, Alphanumeric, Numeric (PIN), and Symbols
Token lengthConfigurable length from 4 to 1,024 characters per token
Batch sizeConfigurable batch from 1 to 100 tokens per execution
Execution deadline2 s
Processing locationBrowser-only: generated tokens are never stored, logged, or sent to a server

How to use

  1. Choose your token format: Hexadecimal (great for HMAC secrets and hash salts), Base64URL (great for URL-safe API keys and session IDs), Alphanumeric, or Symbols (for passwords).
  2. Set the desired token length (default is 32 characters / 256 bits of entropy for hex).
  3. Specify how many tokens to generate in batch (1 to 100).
  4. Click 'Run' to generate fresh cryptographically secure tokens.
  5. Click 'Copy' to copy the generated tokens into your clipboard.

Example

Generate 32-character hex tokens

Input

Sample output (illustrative)

Illustrative sample; live output is cryptographically random
a8f5c3b129e0487d6e1fa5c28b749d03

Edge cases

Entropy and modulo bias

Character selection for alphanumeric and symbol charsets uses cryptographic rejection sampling to completely eliminate modulo bias across non-power-of-two ranges.

No server generation

Every token is drawn directly from your local browser's crypto.getRandomValues API inside a Web Worker. No network requests are made.

Length and count bounds

Lengths are clamped between 4 and 1,024 characters, and counts between 1 and 100 to prevent runaway memory allocation.

How it works

  1. Draws cryptographically strong random bytes using Web Cryptography.
  2. Encodes bytes into the requested format (Hex, Base64, Base64URL) or maps them to characters via rejection sampling.
  3. Repeats the process for the requested batch count and outputs newline-separated tokens.
  4. Runs isolated inside a Web Worker with strict timeout limits.

Related workflows

Frequently asked questions

Are these tokens cryptographically secure?

Yes. The generator uses the browser's native Web Cryptography API (crypto.getRandomValues), which draws from the operating system's cryptographic random number generator (CSPRNG).

Should I use Hex or Base64 for API keys?

Base64URL is generally preferred for API keys and web tokens because it produces shorter strings for the same amount of entropy and is safe in URLs and HTTP headers without escaping. Hexadecimal is preferred for database hashes and HMAC keys.

What length is recommended for an API key?

At least 32 characters (128 to 256 bits of entropy) is standard for secure API keys, session tokens, and webhook secrets. 64 characters provides maximum security for high-risk master keys.

Are generated tokens saved or logged anywhere?

Never. This tool operates 100% locally in your browser with zero backend, zero analytics, and zero network calls. Once you navigate away, the generated values are gone.

References