API token generator — random bearer tokens with a prefix

How to use the API token generator

1. Pick the Randomness: 128, 192, 256, 384 or 512 bits (16 to 64 bytes).
2. Choose an Encoding: Base64url, Hex or Base62.
3. Set a Prefix, or clear it. The default is tr_.
4. Set How many tokens (up to 100) and press Generate.
5. Copy a token. The panel shows the Randomness, the Length in characters including the prefix, and an Example header in the form Authorization: Bearer ….

What it does and when to use it

Many systems need a long secret that no one can guess: personal access tokens, service-to-service API keys, webhook signing secrets, invitation links and password-reset links. This tool makes such strings for setting up a test environment, seeding a config file or issuing a key by hand.

If you need a key for an encryption algorithm rather than a bearer token, use the encryption key generator. For human-friendly secrets, the strong password generator is a better fit. To turn a secret into a signature, see the HMAC generator.

How it works

For Base64url and Hex, the tool asks the browser for the chosen number of random bytes with crypto.getRandomValues, the operating system’s cryptographic random source. It then encodes them: Base64url per RFC 4648 with - and _ and no = padding, or hex with two characters per byte.

For Base62, it draws characters directly from A–Z, a–z and 0–9. Each character carries log₂ 62, about 5.95 bits, so it draws enough characters to reach the chosen bit count: 22 characters for 128 bits, 43 for 256. Each character is picked with rejection sampling, so all 62 are equally likely.

The table shows characters before the prefix. Nothing is sent or stored.

Worked examples

Default settings. 256 bits, Base64url, prefix tr_. Each token is tr_ plus 43 characters, so the tool reports Randomness: 256 bits and Length: 46 characters. The characters change every time you press Generate.

Plain hex. 128 bits, Hex, empty prefix gives 32-character tokens and Randomness: 128 bits, a format that fits a CHAR(32) database column.

A key with a longer prefix. Base62 with prefix sk_test_ produces sk_test_ plus 43 letters and digits, Length: 51 characters.

Limits and tips

• Show a token once, store only its hash, and let users create a new one if they lose it.
• Send tokens only over HTTPS. A bearer token works for whoever holds it.
• This tool does not create JWTs. For signed tokens with claims, use the JWT generator.