Security & CryptoLesson 342Free preview

Token Generator

This lesson is part of Web Developer Tools · All levels

Summary

The token generator creates a random string that is difficult to predict for session, API key, password reset, or CSRF protection. The quality of the token depends on a random source of cryptography, not just numbers from a regular generator. Tokens should be long, valid, and stored in hash form on the server.

Key points

Use CSPRNG like secrets in Python or crypto.randomBytes in Node.js
Modern session tokens are generally at least 32 bytes random
Keep hash tokens in the database, not raw tokens
Set the time and mechanism of the token rotation
Do not use Math.random or system time as the primary source of security tokens

Full lesson

Code examples and quizzes

Full lessons, code examples, and quizzes are available to subscribers. 5 questions.