Generate cryptographically strong random tokens, API keys, secrets and nonces in your browser. Choose length, charset and how many to produce.
Random, unpredictable tokens. All randomness comes from the browser's crypto.getRandomValues, the same source browsers use for TLS keys. Nothing leaves your device.
Most languages ship two very different random number generators. Math.random(), rand() and friends are fast pseudo-random generators seeded from something cheap like the clock. They are fine for shuffling a playlist and disastrous for a token, because an attacker who observes a few outputs can often recover the internal state and reproduce every value the generator will ever emit.
A cryptographically secure generator is built so that seeing past output tells you nothing about future output. In the browser that is crypto.getRandomValues(), which draws from the operating system's entropy pool. This tool uses it exclusively. If you are generating tokens in your own code, the equivalents are secrets in Python, crypto/rand in Go and java.security.SecureRandom in Java — never the plain random module or Math.random().
Having good random bytes is only half the job. The naive way to pick a character is bytes[i] % alphabet.length, which quietly skews the result whenever the alphabet size does not divide 256 evenly. With a 62-character alphabet, the first 8 characters come up slightly more often than the rest — a small bias, but it reduces real entropy and it is entirely avoidable.
The fix is rejection sampling: discard any byte that falls in the incomplete final block and draw again. This tool does that, so every character in the chosen alphabet is equally likely.
Entropy is log2(alphabet_size) * length bits. A 62-character alphabet gives about 5.95 bits per character, so a 22-character token carries roughly 131 bits — comfortably beyond brute force. For anything guarding real access, 128 bits is the usual floor; below about 64 bits a determined attacker with a fast endpoint becomes a genuine concern.
Alphabet choice is mostly about where the token will travel. Base64url and hex survive URLs, filenames and headers untouched. The no-ambiguous alphabet drops characters like 0/O and 1/l/I and is worth using for anything a human will read aloud or retype from a screen.