CSRF Token Generator
Generate cryptographically secure Anti-CSRF (Cross-Site Request Forgery) tokens to protect your forms and API endpoints.
<input type="hidden" name="csrf_token" value="">
<meta name="csrf-token" content="">
headers: {
"X-CSRF-Token": "",
"Content-Type": "application/json"
}
What is a CSRF Token?
Cross-Site Request Forgery (CSRF) is a malicious exploit where unauthorized commands are submitted from a user that the web application currently trusts. To prevent this, developers implement an Anti-CSRF Token—a unique, secret, unpredictable value that is generated by the server-side application and transmitted to the client. When the client makes a state-changing request (like submitting a form or transferring money), it must include this token.
Cryptographic Randomness
A secure CSRF token must be unpredictable. If an attacker can guess the next token, the protection is completely broken. This tool utilizes your browser's native window.crypto API to generate true random bytes, bypassing the inherent weaknesses of standard predictable functions like Math.random().
Hex vs Base64 Formatting
Tokens can be represented in different formats depending on backend requirements. Hexadecimal provides a safe alphanumeric string that works cleanly in URLs and databases. Base64 URL Safe is slightly more compact and is explicitly formatted to avoid characters like + or / that could break HTTP request parsers.