Random Token and API Key Generator
Create random API keys, secrets and tokens in hex, Base64 or Base62.
256 bits of entropy per token
Use via API
Cryptographically random tokens for API keys, session secrets and webhooks, as hex, Base64, Base64url or Base62, with an optional prefix such as sk_live_. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/random-token-generator
curl https://pithlab.com/api/v1/tools/random-token-generator \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"bytes":24,"encoding":"base62","prefix":"pk_test_","count":2}'About the Random Token Generator
Generate secure random tokens, API keys and secrets in hex, Base64, Base64URL or Base62, with an optional prefix. Up to 100 at once, made in your browser.
How to use the Random Token Generator
- Choose how many random bytes each token should have. 32 bytes (256 bits) suits almost any secret.
- Pick an encoding: hex, Base64, URL-safe Base64URL, or Base62 for letters and digits only.
- Add an optional prefix such as sk_live_ so the key is easy to recognise, and set how many tokens you need.
- Press Generate, then copy the token or download the list.
Examples
Input
32 bytes, hex
Output
e.g. 9f4c2a7e1b0d8c3f5a6e2d9b7c1f0a4e8d3b6c2a9f1e7d0c5b4a3e2f1d0c9b8a (256 bits)
Input
24 bytes, Base62, prefix sk_live_
Output
e.g. sk_live_4fK9xQ2mZbT7nW1rLpV8sYcD3hJ6gE0aU (196 bits)
Input
16 bytes, Base64URL
Output
e.g. q3Zt-8Kp_1xW9mYc4LhR2A (128 bits)
Frequently asked questions
How random are these tokens?
Every byte comes from the Web Crypto API (crypto.getRandomValues), the browser's cryptographically secure generator. Base62 characters are drawn with rejection sampling so each of the 62 characters is equally likely. Tokens are made on your device and never sent anywhere.
How many bytes do I need?
16 bytes (128 bits) is enough to make guessing impossible. 32 bytes (256 bits) is a common choice for signing secrets such as HMAC or JWT keys and session secrets.
Which encoding should I choose?
Hex is the simplest and works everywhere. Base64 is shorter but contains + and /. Base64URL swaps those for - and _ and drops padding, so it is safe in URLs and file names. Base62 uses only letters and digits, which is handy for API keys you double-click to select.
Does the prefix make the key stronger?
No. A prefix such as sk_live_ is fixed text, so it adds no entropy. It helps people and secret scanners recognise what the key is for. The bits figure counts only the random part.