Random String & Token Generator
Private by design — runs entirely in your browser
Generate cryptographically random strings — hex, base64, alphanumeric, or custom alphabets — directly in your browser. Toova is the right tool for API keys, session tokens, test fixtures, and any time you need unpredictable data fast.
Pick the alphabet that fits
Hex strings are great for tokens that need to be URL-safe and machine-readable. Base64 packs more entropy per character. Alphanumeric keeps things easy to type and quote. Toova exposes a custom alphabet field so you can include or exclude specific characters — useful when generating coupon codes that need to be readable, or tokens that have to pass through a system that mishandles certain symbols.
Length and entropy
The tool displays the entropy in bits next to the length, so you can pick a value that matches your security requirements. 128 bits is the common floor for session tokens; 256 bits is the floor for long-term API keys. Generating thousands at once lets you seed fixture data without scripting — just pick the count, pick the format, and copy.
Cryptographically secure
Toova uses the browser's cryptographic random number generator, the same source used for TLS keys. The output is unpredictable, even to someone watching every keystroke. Generation runs entirely in your browser — no server involvement, no logging, no analytics on the values themselves. Open the Network tab and verify zero outbound requests during generation.
Frequently Asked Questions
- How long should a random token be?
- For session tokens, 128 bits of entropy is the modern floor (32 hex characters or 22 base64 characters). For long-term API keys, 256 bits is safer. The tool shows the entropy alongside the length so you can pick deliberately.
- Are the strings cryptographically random?
- Yes. The generator uses the browser's secure random source, the same one used to derive TLS session keys. The output is unpredictable, not a pseudo-random sequence with a guessable seed.
- Can I exclude ambiguous characters?
- Yes. The custom alphabet field lets you remove characters that look alike — 0 vs O, 1 vs l vs I. That is useful for codes that humans have to type or read aloud.
- Can I generate strings in bulk?
- Yes. Set the count to whatever you need, up to ten thousand. The output is one string per line, ready to paste into a test fixture or seed file.
- Is anything sent to a server?
- No. Generation happens entirely in your browser. The Network tab will stay empty during use.