⚙️ Format & Size
Random bytes
32
Random Token Generator
API keys, session secrets, nonces and reset tokens — generated from your browser's cryptographic random source in whichever encoding your stack expects.
Latest token
—
🔑 Generated Tokens
🔒 Generated on your device, never transmitted. Tokens come from
crypto.getRandomValues() — the browser's cryptographically secure generator. Nothing is sent to our server, so you can safely generate production secrets here. Do check your browser extensions, though: anything with page-read access could see the result.
HOW IT WORKS
Bytes, Not Characters
The strength of a token comes from how many random bytes back it, not how long the string looks. 32 random bytes is 256 bits of entropy regardless of whether you render it as 64 hex characters or 43 Base64url ones — the encoding changes the length, never the security. That's why the control above asks for bytes: 16 bytes (128 bits) is fine for a session ID or nonce, and 32 bytes (256 bits) is the usual choice for API keys and anything long-lived. Base64url matters specifically because it swaps + and / for - and _ and drops padding, so the token survives being put in a URL or filename without escaping.
What else can you check?
These tools all work on the same connection and address data — pick whichever question you actually have.
Want to see the full path to a site?
DNS, redirects, every hop, the CDN, TLS and the origin server.
Want to know your public IP?
See your IPv4 and IPv6 addresses, location, ISP and ASN.
Want to check your tower & route?
Live ping, speed, DNS, traceroute and a map of nearby points.
Want to ping from around the world?
Real latency from real probes across 12 countries, live on a map.
Want to locate any IP address?
City, region, country and coordinates for any public IP.
Want to know if an IP is risky?
Proxy, VPN, Tor, hosting and abuse-report indicators.
Want to know if you're blacklisted?
Check an address against major spam and abuse DNSBLs.
Want to know who owns an IP?
Network owner, ASN, CIDR range and abuse contact.
Want to explore an AS number?
Announced prefixes, BGP neighbours and registry details.
Want to test your connection speed?
Measure real download, upload, ping and jitter.
Want to see what changed?
Word-level diff between two blocks of text or code.
Token Generator FAQ
How many bytes should I use?
16 bytes (128 bits) is sufficient for session identifiers, CSRF tokens and nonces. 32 bytes (256 bits) is the standard for API keys, signing secrets and password-reset tokens. Going beyond 64 bytes adds length but no meaningful security.
What's the difference between Base64 and Base64url?
Standard Base64 uses +, / and = padding, all of which need escaping in URLs and are invalid in filenames. Base64url replaces them with - and _ and omits padding, so the token can be dropped into a query string or path unchanged.
Is UUID v4 safe to use as a secret?
It's random, but only 122 of its 128 bits are — six are fixed version and variant markers. That's still strong, but UUIDs are designed for uniqueness rather than secrecy and are often assumed non-sensitive by logging tools. For an actual secret, prefer a 32-byte token.
Why does the alphanumeric option produce a different length?
Because it encodes into 62 characters rather than 16 or 64, so the same entropy needs a different number of characters. The entropy figure shown below the list is the honest measure in every format.
Can I trust a website with my production secrets?
Only when you can verify nothing leaves the page — which you can here by opening your browser's network tab while generating. That said, the most cautious approach for the highest-value secrets is always your own machine: openssl rand -hex 32 does the same job offline.