Random Token Generator
Random strings in hex, Base58, Base64 or digits, with the exact number of bits of entropy they carry.
Results
What this tool does
Identifiers, placeholder keys, test fixtures, invite codes, filenames that must not collide: all of them need a run of random characters, and the two questions that matter are which characters are allowed and how many bits the result is worth. Choose the alphabet and the length here and the entropy is worked out for you, so the answer to "is that long enough?" is a number rather than a feeling.
Formula
entropy = length × log2(alphabet size)
Variables
| Symbol | Meaning | Unit |
|---|---|---|
length | Characters per token | — |
alphabet | Characters to use | — |
count | How many | — |
prefix | Put this in front | — |
seed | Seed | — |
OUT | The tokens | — |
EN | Entropy | bits |
AS | Characters to choose from | — |
TL | Characters in the whole thing | — |
Worked example
- Characters per token32
- Characters to usehex
- How many3
- Put this in front
- Seed7
- The tokens00fb86738b42c835484f3e32248c1e89 af9ed025601c567fbb5522e53a50ae8d ae18aefd9ff8d085b8cf8d6ab84300fd
- Entropy128.0 bits
- Characters to choose from16
- Characters in the whole thing32
Limitations
- The calculation runs entirely in your browser. The values you type are never sent to a server.
Frequently asked questions
Is this safe to use as a real secret?
Read this before you use one. The draw comes from a seeded generator, chosen so that the same seed always gives the same result and the page can be tested. The seed itself is taken from the browser's cryptographic source each time you press the button, so a token you generate here and use once is not predictable in practice — but the generator downstream of that seed is not a cryptographic one. For an API key protecting something that matters, take the value from your own system's secure random source instead; for a placeholder, a test fixture or an identifier, this is exactly the right tool.
What is Base58 for?
For anything a human might have to read aloud, copy by hand or type off a screen. It is the usual alphabet with the four characters that get confused removed: zero, capital O, capital I and lower-case l. The result is slightly longer than Base64 for the same strength and very much harder to get wrong over the phone.