Draw random bytes and read them as hex or base64url. Generated in your browser, nothing is sent to a server.
Hit Generate and a fresh token shows up here.
A token here is a string of random bytes, written as hex or as base64url. Each byte is drawn with crypto.getRandomValues, so every one of the 256 values is equally likely. The bit count is 8 times the number of bytes: 32 bytes is 256 bits.
Hex uses two characters per byte, 0-9 and a-f. Base64url follows RFC 4648 section 5: the alphabet uses - and _ instead of + and /, and the padding = is omitted.
bytes 0x00 0xFF
00ff
bytes 0x00 0xFF
AP8
This is not a password you can type from memory. It has no letter-and-digit alphabet. For that, use the password generator. A token is a secret to store, not to recite.
Base64url here has no trailing =. A decoder that requires padding has to put it back so the length is a multiple of 4.
The bit count belongs to the tokens on screen. If you change the byte length and do not generate again, the warning says the settings and the tokens disagree.
Length is 8 to 64 bytes. The batch stops at 20. Hex is lowercase. A shared link is accepted only when every value matches the encoding and the byte length.
The share link stores the byte length, the encoding and the token strings. Opening it does not draw new bytes.
crypto.getRandomValues is the Web Crypto way to fill a typed array from the browser’s cryptographic generator. The page does not seed that generator.
RFC 4648, “The Base16, Base32, and Base64 Data Encodings”, was published in October 2006. Section 5 defines the URL and filename safe alphabet, with - and _ in place of + and /.