Token Generator
- 62
- Alphabet size
- 32
- Length
- 191
- Entropy (bits)
- Strong
- Strength
The token generator produces random strings from four alphabets (base62, base64url, hexadecimal and digits) and shows the entropy in bits for the length you choose. Entropy is displayed because length alone tells you very little: a 32-character hex token and a 32-character base62 token differ by 62 bits.
How it works
entropy in bits = length x log2(alphabet size)
- alphabet size
- 62 for base62, 64 for base64url, 16 for hex, 10 for digits
- log2
- bits contributed by each character, about 5.95 for base62, 4 for hex, 3.32 for digits
Characters come from crypto.getRandomValues with rejection sampling, so every character is equally likely. The naive approach of taking a random value modulo the alphabet size very slightly favours the first few characters, which reduces effective entropy.
- Below 80 bits is weak for anything an attacker can attempt offline.
- 80 to 128 bits is adequate for session identifiers and short-lived tokens.
- 128 bits and above is the standard target for API keys and long-lived secrets.
Examples
A 32-character base62 token
Alphabet
Base62
Length
32
Result
190 bits of entropy: comfortably above the 128-bit target
32 characters x log2(62) = 32 x 5.954 = 190 bits. This is the usual shape of an API key.
The same length in hexadecimal
Alphabet
Hexadecimal
Length
32
Result
128 bits of entropy: exactly at the target, from the same character count
Hex contributes 4 bits per character against base62’s 5.95, so the same visible length carries 62 fewer bits. This is why quoting token length without the alphabet is meaningless.
Frequently asked questions
How long should an API key be?
128 bits of entropy is the practical minimum, which is 22 base62 characters or 32 hex characters. Beyond about 256 bits there is no security benefit. The limit becomes how the key is stored and transmitted, not how hard it is to guess.
Why does the alphabet matter as much as the length?
Because each character carries a different amount of information. A 20-character digits-only token has 66 bits; a 20-character base62 token has 119. Quoting a length without the alphabet says almost nothing about strength.
Is this suitable for generating production secrets?
The randomness is sound. It uses the same Web Crypto API a server would. The weak point is the browser and the clipboard, so for high-value production secrets generate them where they will live rather than pasting them across a network.
What is base64url and when do I need it?
Base64 with - and _ replacing + and /, so the result is safe in a URL or filename without escaping. Use it for tokens that appear in links, such as password reset or email confirmation tokens.