Random string generator for keys, tokens and IDs

Each character from an alphabet of size N carries log2(N) bits. To reach a target strength, divide the bits you need by the bits per character. These are the lengths for 128 and 256 bits:

Use hex or Base64url for secrets that only machines read, like webhook signing keys or SESSION_SECRET. Use Base58 or Crockford Base32 for codes people read or type, such as licence keys and coupon codes, since they leave out characters that look alike. Lowercase + digits suits subdomains and other case-insensitive places.

Many services put a short, readable prefix in front of the random part. Stripe keys start with sk_live_, sk_test_ or pk_live_, so you can tell a secret key from a publishable one and live from test at a glance. GitHub tokens start with ghp_ (personal access token), gho_ (OAuth), ghu_, ghs_ or ghr_, and end with a CRC32 checksum so scanners can reject fake matches without a lookup.

To make keys in that style here:

• Click the API key preset: 32 alphanumeric characters (about 190 bits) after sk_test_.
• Change the prefix to your own, for example acme_live_. Keep it unique to your product so secret scanners can match it.
• Pick .env as the output format to get lines like API_KEY=… ready to paste.

Store only a hash of each API key on the server (SHA-256 is enough for random keys), and show the full key to the user once.

Every major language has a secure random source. These match what the tool does:

// Browser JavaScript: 32 random bytes as hex
const bytes = crypto.getRandomValues(new Uint8Array(32));
const hex = Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');

// Node.js
const { randomBytes, randomInt } = require('node:crypto');
randomBytes(32).toString('base64url');          // 43 chars, 256 bits
const a = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
Array.from({ length: 32 }, () => a[randomInt(a.length)]).join('');

# Python
import secrets, string
secrets.token_hex(32)                           # 64 hex chars
secrets.token_urlsafe(32)                       # 43 Base64url chars
''.join(secrets.choice(string.ascii_letters + string.digits) for _ in range(32))

// Go 1.24+
rand.Text()                                     // Base32, at least 128 bits

# Terminal
openssl rand -hex 32
LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 32; echo

For identifiers rather than secrets, a UUID or Nano ID is often a better fit. To sign a token with a key you made here, try the JWT generator.

Using Math.random(). It is a fast general-purpose generator, not a cryptographic one, and its future output can be worked out from past output. Fine for shuffling a demo list, wrong for anything secret.

Modulo bias. The common shortcut alphabet[byte % 62] is uneven: 256 = 4 × 62 + 8, so the first 8 characters of the alphabet come up 5 times in 256 and the rest only 4. Over many strings that is measurable and lowers the real entropy. This tool uses rejection sampling: it draws a 32-bit number, throws it away if it falls in the uneven tail, and draws again. The tr -dc command above is unbiased for the same reason, since it simply drops bytes outside the set.

Need a password a person will type rather than a token? The password generator has passphrases, look-alike filtering and a crack-time estimate. For products that manage secrets for you, see security tools on DevHunt.