Skip to main content
Back to Numbers generators

Numbers

Random String Token Generator

Used by developers, writers, and creators worldwide.

A random string token generator is an essential tool for developers building authentication systems, API integrations, and session management workflows. Set your token length, pick a character set — alphanumeric, hex, uppercase, or numeric — and generate a batch of tokens instantly, no backend required. Token length and character set determine entropy. A 32-character alphanumeric token draws from 62 characters, yielding roughly 190 bits of entropy. Hex tokens use only 16 characters, so you need longer strings for equivalent randomness. This generator is ideal for development, testing, and seeding workflows. For production secrets, reach for Node's `crypto.randomBytes` or Python's `secrets` module instead.

Loading usage…

Free forever — no account required

How to use

  1. Choose your options above
  2. Click Generate
  3. Copy your result

Detailed instructions

  1. Set the Token Length field to match your use case — 32 for API keys, 6 for PINs, 64 for high-security secrets.
  2. Choose a Character Set: alphanumeric for general use, hex for checksum-style tokens, numeric for PIN codes.
  3. Set 'How Many' to the number of tokens you need — increase it to generate a full batch at once.
  4. Click Generate to produce the token list, then copy individual tokens or the full list into your project.

Use Cases

  • •Seeding a Postgres staging database with unique API keys for 50 test user records
  • •Mocking session tokens in Jest or Cypress to test Express authentication middleware
  • •Generating a batch of hex tokens to populate a Postman environment variable file
  • •Creating numeric-only 6-digit verification codes for an SMS flow prototype
  • •Provisioning one-time invite codes for a live workshop with multiple attendees

Tips

  • →For tokens stored in environment variables, 32-character alphanumeric is the sweet spot — readable in a .env file and high entropy.
  • →Hex tokens are easier to validate with a simple regex (`^[0-9a-f]+$`), which helps when building input sanitization.
  • →Generate 20-30 tokens at once for invite code pools, then store them in a database marked 'unused' until claimed.
  • →Uppercase-only tokens reduce ambiguity in printed or spoken codes — fewer mix-ups between '0' and 'O' or '1' and 'l'.
  • →If you need a UUID-shaped token, generate a 32-character hex token and insert hyphens at positions 8, 12, 16, and 20.
  • →Always pair short tokens (under 20 chars) with an expiry time — low entropy becomes exploitable when tokens are long-lived.

FAQ

how long should a random string token be for API keys

32 characters is a solid minimum using an alphanumeric character set, giving around 190 bits of entropy. For high-value tokens like refresh tokens or password reset links, use 64 characters. Short tokens — 16 characters or fewer — are only appropriate for low-risk uses like display codes.

are these generated tokens cryptographically secure

No. This generator uses JavaScript's Math.random(), which is not cryptographically secure. Don't use these tokens for production password resets, signing secrets, or session identifiers. For those cases, use Node's `crypto.randomBytes()` or Python's `secrets.token_hex()` instead.

what's the difference between alphanumeric and hex tokens

Alphanumeric tokens draw from 62 characters (a–z, A–Z, 0–9), while hex tokens use only 16 (0–9, a–f). To match the same entropy, a hex token needs to be roughly 1.5x longer. Use hex when a downstream system expects that format; use alphanumeric when you want maximum randomness per character.