How many bytes should an API key be?

32 bytes, which is 256 bits, is the usual choice and is far beyond brute-force reach. 16 bytes is acceptable for short-lived tokens.

Is this random enough for production secrets?

Yes. crypto.getRandomValues() is the browser's cryptographically secure pseudorandom generator, seeded by the operating system. It is the same class of source a server-side library would use.

When should I use Base64URL instead of Base64?

Whenever the token will appear in a URL or a filename. Base64URL replaces + and / with - and _, so the value survives a path segment, a query string, and form decoding, where a + would otherwise turn into a space.

Generators / LOCAL TOOL

Random Token Generator

Generate cryptographically secure random tokens locally in your browser.

Runs locally — input is never uploaded

OutputReady when you are

Bytes Quantity

WHAT IT DOES

Secrets that no server has ever seen.

Generate API keys, session secrets, and signing keys as Hex, Base64, or Base64URL. Choose the byte length and the number of tokens. Every byte comes from crypto.getRandomValues(), never from Math.random().

Why use it?

Use it when a system needs random bytes expressed as text, rather than a memorable password or a formatted record identifier.

How to use this tool

Choose the byte count, output encoding, and quantity, then generate.
Distinguish bytes from displayed characters: 32 random bytes produce 64 hexadecimal characters. Choose Base64URL when the receiving system specifically expects that alphabet.
Store the result through your normal secret-management process. The tool does not register, retain, or recover tokens, and the receiving service determines the required length and format.

Details and limitations

Byte length is configurable from 1 to 512; 32 bytes is the common default for an API key.
Hex, Base64, and Base64URL output are available; Base64URL is safe to place in a URL or filename.
Up to 20 tokens can be generated at once for seeding multiple environments.

COMMON QUESTIONS

Random Tokens questions

How many bytes should an API key be?: 32 bytes, which is 256 bits, is the usual choice and is far beyond brute-force reach. 16 bytes is acceptable for short-lived tokens.
Is this random enough for production secrets?: Yes. crypto.getRandomValues() is the browser's cryptographically secure pseudorandom generator, seeded by the operating system. It is the same class of source a server-side library would use.
When should I use Base64URL instead of Base64?: Whenever the token will appear in a URL or a filename. Base64URL replaces + and / with - and _, so the value survives a path segment, a query string, and form decoding, where a + would otherwise turn into a space.