Secure Token Generator

Generate cryptographically secure API keys, Bearer tokens, webhook secrets, and session identifiers in Hex, Base64, URL-safe Base64URL, or Base62 formats.

Category: Generators

How to Use Secure Token Generator

  1. Set the random byte length (32 bytes = 256 bits of entropy, recommended for HMAC-SHA256 and JWT signing secrets).
  2. Select the Token Encoding Format: Hexadecimal, Base64URL (URL-safe), Base64 Standard, or Base62 Alphanumeric.
  3. Optionally enter a key prefix (such as 'sk_live_', 'pk_test_', or 'whsec_') for secret scanning and key identification.
  4. Click Execute Secure Token Generator to create and copy your token locally in your browser.

Related Generators Tools

  • HMAC Generator

    Generate HMAC signatures (HMAC-SHA-256, SHA-384, SHA-512) locally in browser using Web Crypto API.

  • JWT Decoder & Inspector

    Decode and view JSON Web Token headers, payload, and claims.

  • Password Generator

    Generate cryptographically secure random passwords in your browser with customizable length, character sets, ambiguous-character filtering, and Shannon entropy analysis.

  • UUID Generator

    Generate RFC 4122 / RFC 9562 compliant Version 4 UUIDs (Universally Unique Identifiers) and GUIDs in bulk up to 500 at once with uppercase, compact hex, and brace formatting.

  • Hash Generator (MD5, SHA-256, SHA-512)

    Compute cryptographic cryptographic hashes for text inputs.

Frequently Asked Questions

How many bytes should I use for a JWT secret or HMAC-SHA256 signing key?

According to RFC 7518 (JSON Web Algorithms), an HMAC-SHA256 (HS256) secret key must be at least 256 bits (32 random bytes), and an HMAC-SHA512 (HS512) key should be at least 512 bits (64 random bytes). Using 32 bytes in Hex produces a 64-character hexadecimal string with a full 256 bits of entropy.

What is the difference between Base64, Base64URL, and Base62 encoding?

Standard Base64 uses '+', '/', and '=' padding, which must be percent-encoded in URLs. Base64URL replaces '+' with '-', '/' with '_', and strips '=' padding so tokens are safe in URLs and HTTP headers. Base62 uses only alphanumeric characters (0–9, A–Z, a–z) so double-clicking selects the entire token in any terminal or editor.

Why do modern APIs add prefixes like 'sk_live_' or 'ghp_' to secret tokens?

Adding a recognizable prefix (such as 'sk_live_' for live secret keys or 'whsec_' for webhook secrets) lets developers immediately identify what environment a key belongs to and allows automated secret scanners (like GitHub Secret Scanning or GitGuardian) to detect accidentally committed keys.

How many characters does a 32-byte Hex or Base64 token contain?

Each random byte (8 bits) requires 2 hexadecimal characters, so a 32-byte Hex token is 64 characters long (256 bits of entropy). In Base64, 32 bytes encode into 44 characters (or 43 characters in unpadded Base64URL).

Are generated API keys and secret tokens completely private?

Yes. Token generation executes 100% client-side in your browser using window.crypto.getRandomValues(). No generated token is ever transmitted over the network, logged, or stored.