CSRF Token Generator
Generate cryptographically random anti-CSRF tokens in hex, Base64 or Base64URL, one at a time or in bulk, with a hidden-field snippet to paste. It runs in your browser.
A CSRF token is the unguessable value a form sends back to prove a request really came from your own page, and this CSRF token generator makes them with the browser’s cryptographic random source. Set how many bytes of entropy you want, pick hex, Base64 or Base64URL, and generate a single random csrf token or a batch for seeding a test database. As an anti-csrf token maker it also shows the hidden <input> field you’d drop into a form and explains the double-submit-cookie check. Every value comes from crypto.getRandomValues, not Math.random, so the tokens are safe to actually use. Need general-purpose random strings or API keys instead? The token generator covers those.
How it works
- 1
Set the entropy
Choose how many random bytes each token carries. 32 bytes (256 bits) is a solid default for anti-forgery tokens.
- 2
Pick a format and count
Switch between hex, Base64 and Base64URL, and generate one token or a whole batch at once.
- 3
Copy the token or the field
Copy a single value, copy them all, or grab the ready hidden-input snippet for your form.
Instant & 100% private — nothing is uploaded
Everything runs locally in your browser. Your code, text and files are processed on your own device and are never sent to a server — so there are no upload waits, no size limits from us, and nothing is ever stored or logged.
Frequently asked questions
- What is a CSRF token for?
- It defends against cross-site request forgery. Your server embeds a random token in each form or session, and rejects any state-changing request that doesn’t send the matching value back. An attacker’s forged request can’t guess it, so it’s blocked.
- How long should a CSRF token be?
- 128 bits of entropy is the usual floor; 256 bits (32 bytes) is a comfortable, common choice. This csrf token maker shows the bit count as you change the byte length so you can see where you stand.
- Which format should I choose?
- Base64URL is safe to put in URLs and hidden fields without escaping. Hex is the most portable and easy to log. Plain Base64 is compact but can contain + / = characters. Pick whatever your framework expects.
- Are these tokens cryptographically secure?
- Yes. Each anti-csrf token is drawn from crypto.getRandomValues, the browser’s cryptographically secure random generator — never Math.random — so the output is suitable for real security use.
- How does the double-submit cookie pattern work?
- You set the same random value in a cookie and in a hidden form field, then reject any POST where the two don’t match. Since another site can’t read your cookie to copy it into a forged request, the check holds.
- How is this different from the general token generator?
- The copy and defaults here are tuned for anti-forgery tokens — entropy in bytes, a hidden-field snippet, the double-submit note. For arbitrary random strings, passwords or API keys, use the general token generator instead.
More tools
More from the Hivly network
Free sister tools on our other sites.
