PrivTab

Secure Token Generator

Make random tokens for API keys, signing secrets, session IDs and one-time codes, with their strength shown in bits.

Runs in your browser · No uploads

–
  • Nothing leaves your device
  • No server-imposed size limits
  • No sign-up, no watermark
  • Free

How to generate a secure token

  1. Choose the format and strength (or length).
  2. Add a prefix if your keys use one, like sk_live_.
  3. Copy or download the tokens.

Which strength to choose

  • 128 bits is the minimum for API keys, secrets and session IDs.
  • 256 bits suits signing keys (for example JWT HS256 secrets) and long-lived secrets.
  • Digits-only codes are for short-lived codes only: 6 digits is about 20 bits.

How the tokens are made

Every token comes from your browser's cryptographic random generator (crypto.getRandomValues), the same one used for encryption keys. Letters are picked without bias, so every character is equally likely. Nothing is stored or sent: once you leave the page, the tokens exist only where you copied them.

Frequently asked questions

How is this different from the Password Generator?

The Password Generator makes passwords for people to type and remember. This makes machine secrets: API keys, signing secrets and IDs, in hex or Base64.

Are the tokens sent anywhere?

No. Everything happens in your browser, and the page is blocked from uploading anything.