CSRF Token Generator

Summary

A free, client-side CSRF token generator that uses the browser's built-in <code>crypto.getRandomValues()</code> API to produce cryptographically secure random tokens. Select token byte length (16, 32, or 64 bytes) and output format (hex, base64, or base64url). The tool displays the token entropy in bits and provides one-click copy to clipboard. No data leaves your browser.

How it works

1. Select the desired token byte length: 16 (128-bit), 32 (256-bit), or 64 (512-bit).
2. Choose an output format: hex, base64, or base64url (URL-safe, no padding).
3. Click "Generate Token" or any option to produce a new cryptographically random token.
4. The entropy in bits is calculated and displayed alongside the token.
5. Click "Copy" to copy the token to your clipboard for use in your application.

Use cases

• Generate a one-time CSRF token to embed in HTML forms as a hidden field.
• Create synchronizer tokens for AJAX requests sent as custom headers.
• Produce URL-safe tokens for double-submit cookie CSRF mitigation patterns.
• Generate secure nonces for Content Security Policy (CSP) headers.
• Test CSRF protection implementations during security audits.

Frequently Asked Questions