What is an access token generator? +
An access token generator creates random strings shaped like real API credentials. TokenTonic generates mock tokens — API keys, Bearer tokens, hex secrets, base64url strings and mock JWTs — for development, testing and documentation. They look real but grant access to nothing.
Can I use these tokens with a real API? +
No. Real APIs validate tokens against their own servers, and only provider-issued keys work. These are random strings from your browser; every real API will reject them. That is the point — safe test data.
What is the difference between an API key and an access token? +
An API key is usually long-lived and identifies a project; an access token (often via OAuth 2.0) is short-lived and identifies a user plus their permissions. See our access tokens guide for the full comparison.
Are mock JWTs valid JWTs? +
Structurally yes — real header.payload.signature with base64url encoding — but they are unsigned (the signature is random bytes, not a real signature) and the payload is labeled mock. They will fail any real signature verification, which is exactly what you want from test data.
How should I store real API keys? +
In environment variables or a secrets manager — never in source code, never committed to git. Rotate on a schedule and after any suspected exposure. Full guidance in our security practices guide.
What do the sk- and ak- prefixes mean? +
They identify the key type at a glance: sk- for secret keys, ak- for access keys. Secret scanners recognize these prefixes, which is one more reason providers use them — and why the generator offers them.
Is the generator free? Is there a limit? +
Completely free, no account, no usage limits. Generate as many mock tokens as your tests need.
Is the generator private? +
Yes. Everything runs in your browser with crypto.getRandomValues() — no network calls, no cookies, nothing stored. Details on the privacy page.
Can mock tokens expire? +
The random-string formats do not carry expiry — they are just strings. The mock JWT includes an iat (issued-at) timestamp in its payload, but no signature ties it to a real issuer, so no server will honor or expire it.
Why do my tokens show an entropy value? +
The output line shows approximate bits of entropy (for example ~128 bits for a 32-char hex token) so you can sanity-check the strength of the format you chose. The formats guide explains the math.