Generate cryptographically secure CSRF tokens as hex with configurable byte length (16–128). Code never leaves your device — generation runs locally in your browser.
Content reviewed October 2026 · About Toolzum
Generate random tokens in hex, base64, or alphanumeric formats for secrets and sessions. Hex and base64 draw from Web Crypto (alphanumeric uses Math.random — see format notes). The API-key preset mints 64-char secrets in one click — local generation, free, no signup.
Generate secure API keys with configurable length, character set, and optional prefix. Use with any authentication scheme.
Inspect any string — view character count, byte length, word count, line count, Unicode code points, and non-ASCII character breakdown.
Generate random MAC addresses for labs and testing — pure random hex, no OUI or unicast-bit management. Fill virtual networks credibly — local generation, free, no signup.
Generate OTP codes — numeric, alphabetic, or hex — in batches of your chosen length. Make verification codes fast — free, local, no signup.
A CSRF (Cross-Site Request Forgery) token is a unique, unpredictable value embedded in forms to verify that submissions originate from your site, not a malicious third party.
The tool uses the Web Crypto API to generate cryptographically secure random bytes, rendered as hex. The output is suitable for production use.
Hex only — no encoding picker. Convert the hex with your own code if a transport needs base64url.
32 bytes (256 bits) is the recommended minimum for cryptographic security. This provides 2^256 possible values, making brute-force attacks computationally infeasible.
Yes. Tokens are generated using the browser's Web Crypto API. No token data is sent to any server.
OAuth2 Debugger
Debug OAuth2 flows step by step — authorize URLs, code exchange, token inspection. Fix redirect_uri_mismatch in minutes — local tooling, free, no signup.
CSP Policy Validator
Validate Content Security Policy headers against W3C spec and common pitfalls. Code never leaves your device — formatting and validation run locally in your browser.