Random Token & UUID Generator — Secure API Keys, UUIDs and Hex Tokens

Our free random token generator creates cryptographically secure UUIDs (v4), hex tokens, Base64 tokens and API keys using the browser's Web Crypto API. All tokens are generated entirely in your browser — nothing is sent to any server. Use these tokens for API keys, session tokens, CSRF protection, database primary keys, webhook secrets and cryptographic nonces.

UUID v4 — What It Is and When to Use It

A UUID (Universally Unique Identifier) version 4 is a 128-bit randomly generated identifier in the format xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx. The probability of generating a duplicate UUID is astronomically small — approximately 1 in 5.3×10³⁶. UUIDs are used as primary keys in distributed databases (avoiding sequential ID predictability), resource identifiers in REST APIs, correlation IDs for distributed tracing, and file names for user uploads.

Token Types and Use Cases

• UUID v4 — Database primary keys, REST API resource IDs, file upload names. Human-readable format, database-friendly.
• Hex token (32 bytes = 64 hex chars) — CSRF tokens, session IDs, OAuth state parameters, webhook signing secrets.
• Base64 URL-safe token — JWT secrets, cookie values, URL-safe tokens where hex is too long.
• Alphanumeric API key (40 chars) — User-facing API keys, integration credentials, authentication tokens.

Cryptographic Security of Generated Tokens

All tokens are generated using crypto.getRandomValues() — a CSPRNG (Cryptographically Secure Pseudo-Random Number Generator) that is seeded from hardware entropy sources. This is fundamentally different from Math.random(), which is NOT cryptographically secure and should never be used for security tokens. With 256 bits of entropy (32 bytes), these tokens are immune to brute-force attacks and guessing.

API Key Security Best Practices

• Never commit API keys to version control — use environment variables or secrets managers
• Use different API keys for development, staging and production environments
• Implement API key rotation policies and invalidate old keys after rotation
• Log API key usage (not the key itself) to detect compromised credentials
• Hash stored API keys with SHA-256 — store the hash, not the plaintext key