Last updated
Security Best Practices
- Always transmit bearer tokens over HTTPS — they grant access to whoever holds them
- Use short expiration times (15 minutes to 1 hour) for access tokens
- Implement refresh tokens for long-lived sessions instead of long-lived access tokens
- Store tokens in httpOnly cookies or secure memory, not localStorage (vulnerable to XSS)
- Never log Authorization headers — they contain credentials
- Rotate tokens regularly and implement revocation for sensitive applications
- Use 256-bit (32-byte) minimum entropy for random tokens
The generator uses a cryptographically secure random number generator. All token generation happens in your browser — no tokens or secrets are sent to any server.
Examples
Example 1: Generating a Random Bearer Token
A developer is building an internal API and needs a secure token for service-to-service authentication. They generate a 64-character URL-safe Base64 token:
Token length: 64 characters
Format: Base64 URL-safe (A-Z, a-z, 0-9, -, _)
Entropy: 256 bits
Generated token:
xK9mP2vL8nQ4rT7wY1sA3dF6hJ0cB5eG-iN8oU2pX4qZ7tW1yR3uV6kM9lH0jC
Authorization header:
Authorization: Bearer xK9mP2vL8nQ4rT7wY1sA3dF6hJ0cB5eG-iN8oU2pX4qZ7tW1yR3uV6kM9lH0jCThe token is stored in an environment variable on the server and in the calling service's configuration. It is never hardcoded in source code.
Example 2: Generating a JWT Token
A developer is implementing user authentication and needs to generate a JWT access token with standard claims:
Header:
{
"alg": "HS256",
"typ": "JWT"
}
Payload:
{
"sub": "user_12345",
"name": "Jane Developer",
"email": "jane@example.com",
"roles": ["user", "editor"],
"iat": 1710000000,
"exp": 1710003600
}
Secret key: your-256-bit-secret
Generated JWT:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiJ1c2VyXzEyMzQ1IiwibmFtZSI6IkphbmUgRGV2ZWxvcGVyIiwiZW1haWwiOiJqYW5lQGV4YW1wbGUuY29tIiwicm9sZXMiOlsidXNlciIsImVkaXRvciJdLCJpYXQiOjE3MTAwMDAwMDAsImV4cCI6MTcxMDAwMzYwMH0.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Authorization header:
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...The JWT is self-contained — the server can verify it by checking the signature without a database lookup. The exp claim sets expiration to 1 hour after issuance.
Example 3: Decoding a JWT for Debugging
A developer receives a bug report that a user's token is being rejected. They paste the JWT into the decoder to inspect its contents:
Input JWT:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzk5OSIsImV4cCI6MTcwOTk5OTk5OX0.abc123
Decoded header:
{
"alg": "HS256",
"typ": "JWT"
}
Decoded payload:
{
"sub": "user_999",
"exp": 1709999999
}
Token status:
Issued at: Not present (iat claim missing)
Expires at: 2024-03-09 23:59:59 UTC
Status: EXPIRED (expired 6 days ago)The decoder shows the token expired 6 days ago. The developer identifies that the client is caching tokens without checking expiration. The fix is to implement token refresh logic in the client.