Generate a value

--- copy

Where does the randomness come from?

A session or access token's whole job is being unguessable; if an attacker can predict or narrow down the token space, the token stops protecting anything.

This tool draws URL-safe random bytes from Galactropy's physical SDR entropy pool and encodes them into a token string, so the character selection isn't driven purely by a server's local PRNG state.

⚠ Cryptographic notice

Treat generated tokens like passwords: transmit them only over HTTPS, store them hashed if you persist them server-side, and give them an expiry rather than letting them live forever.

Frequently asked questions (FAQ)

How long should a session token be?

32 bytes (256 bits) of underlying randomness is a common baseline for session and access tokens, comfortably beyond what's brute-forceable, even encoded as a longer text string.

Can I use this for password-reset links?

Yes, that's a typical use case: just make sure the link expires quickly and is invalidated after first use.