How Do I Generate Random API Tokens From The Terminal?

API tokens are everywhere: personal access tokens, webhook secrets, session keys, “bearer” strings for internal tools, and one-off secrets you hand to a teammate for testing. When you need a strong random token quickly, the terminal is often the fastest and most dependable place to create it—no extra apps, no copy-pasting from questionable generators, and no waiting on a UI.

This article walks through practical ways to generate random API tokens from a computer terminal, with examples for macOS, Linux, and Windows. It also covers token length choices, encoding formats, and safe handling tips.

What makes a good API token?

A solid API token should be:

• Unpredictable: generated from a cryptographically secure random source.
• Long enough: resistant to guessing and brute force.
• Easy to store and transmit: often as hex or Base64 text.
• Unique: one token per client/app/service whenever possible.

How long should it be?

A common target is 128 bits of randomness minimum for many use cases, and 256 bits for high-value tokens.

• 128-bit token
  • Hex: 32 characters
  • Base64: 22 characters (often 24 with padding ==)
• 256-bit token
  • Hex: 64 characters
  • Base64: 43 characters (often 44 with padding =)

If you’re unsure, generate 256 bits. The extra length is rarely a problem and raises the bar significantly.

Prefer cryptographically secure random sources

On Unix-like systems, the safest sources are provided by the OS: /dev/urandom and tools that call secure system APIs. On Windows, PowerShell has cryptography helpers.

Avoid using random() in scripting languages unless it’s clearly a crypto-safe generator.

Generate tokens with OpenSSL (macOS/Linux)

OpenSSL is widely available and straightforward.

Hex tokens

Generate a 32-byte (256-bit) token as hex:

1openssl rand -hex 32

Example output (yours will differ):

1a8f4c9d2e6b1c0d6d8a1c6a1b7a7e4f3cfe9d0a2e19b0d4aa9c1e2e5d8f0a1b2c3d4

Base64 tokens

Generate 32 bytes and encode as Base64:

1openssl rand -base64 32

This may include + and /, which can be awkward in URLs. If you need something URL-friendly, see the Base64url section below.

Generate tokens with head + /dev/urandom (macOS/Linux)

This method is simple and works on most systems.

Hex encoding using xxd

1head -c 32 /dev/urandom | xxd -p -c 256

• head -c 32 reads 32 bytes (256 bits).
• xxd -p prints plain hex.

Base64 encoding using base64

1head -c 32 /dev/urandom | base64

If you want a single line without wrapping:

1head -c 32 /dev/urandom | base64 | tr -d '\n'
2echo

Generate tokens with python (macOS/Linux/Windows)

Python’s secrets module is built for secure tokens.

URL-safe tokens (recommended for many APIs)

1python3 -c "import secrets; print(secrets.token_urlsafe(32))"

Notes:

• The number 32 here is bytes before encoding, not characters.
• Output is Base64url-like and typically safe in URLs, headers, and config files.

Hex tokens

1python3 -c "import secrets; print(secrets.token_hex(32))"

That prints 64 hex characters (256 bits).

Generate tokens with node (macOS/Linux/Windows)

Node.js can generate secure random bytes via the crypto module.

Hex token

1node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

Base64 token

1node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"

If you need a URL-safe variant, you can replace characters and trim padding:

1node -e "console.log(require('crypto').randomBytes(32).toString('base64').replace(/\+/g,'-').replace(/\//g,'_').replace(/=+$/,''))"

Generate tokens on Windows with PowerShell

PowerShell can pull secure random bytes and encode them cleanly.

Hex token (256-bit)

1$bytes = New-Object byte[] 32
2[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
3($bytes | ForEach-Object { $_.ToString("x2") }) -join ""

Base64 token (256-bit)

1$bytes = New-Object byte[] 32
2[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
3[Convert]::ToBase64String($bytes)

Base64url token (URL-friendly)

1$bytes = New-Object byte[] 32
2[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
3$b64 = [Convert]::ToBase64String($bytes)
4$b64.TrimEnd("=") -replace '\+','-' -replace '/','_'

Base64 vs hex: which should you pick?

Both are fine; choose based on where the token goes.

• Hex
  • Pros: only 0-9a-f, very copy/paste friendly, rarely needs escaping
  • Cons: longer output for the same randomness
• Base64
  • Pros: shorter output
  • Cons: may include characters that need encoding in URLs or some config contexts
• Base64url
  • Pros: shorter and URL/header friendly
  • Cons: not always the default option in tooling (but easy to produce)

If the token might appear in a URL path or query string, Base64url or hex is usually the least painful.

Quick recipes (copy/paste)

256-bit hex (macOS/Linux)

1openssl rand -hex 32

256-bit Base64url (Python)

1python3 -c "import secrets; print(secrets.token_urlsafe(32))"

256-bit hex (Node)

1node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

256-bit Base64url (PowerShell)

1$bytes = New-Object byte[] 32
2[System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
3([Convert]::ToBase64String($bytes)).TrimEnd("=") -replace '\+','-' -replace '/','_'

Safe handling tips in the terminal

Generating a strong token is only half the job; handling it poorly can still leak it.

• Avoid saving tokens in shell history: commands that print secrets can end up in history. Consider turning off history temporarily in your shell session or generating via a script file you delete afterward.
• Avoid pasting tokens into shared chat: use a secret manager or a secure channel.
• Limit token scope: if your system supports scopes/permissions, grant the minimum needed.
• Set expiration when possible: short-lived tokens reduce risk.
• Rotate tokens: treat rotation as routine, not as emergency work.

The terminal offers quick, repeatable ways to create strong API tokens using trusted system randomness. Pick a tool you already have, choose a length like 32 bytes (256 bits), and output in hex or Base64url depending on where the token will live. With a few reliable one-liners, you can generate tokens on demand without relying on web tools or manual guesswork.