Secure Token Generation

CSPRNG common uses:

Session tokens: 16-32 random bytes. Used as session identifier (in cookie or auth header).

Password reset tokens: similar, but PER-USER, time-limited.

API keys: longer, prefixed for visual identification:

CSRF tokens: per-session, embedded in forms.

OAuth state: prevents CSRF on OAuth callbacks.

Cryptographic salts: per-password, attached to password hashes.

IVs/nonces: per-message for symmetric encryption. CRITICAL for AES-GCM, ChaCha20.

NIST minimum: 112 bits of entropy (~14 bytes). Modern apps use 128-256 bits.

Don't use: timestamps, sequential IDs, UUIDv4 (which IS random but uses 122 bits, fine for IDs but not auth tokens for paranoid systems).

Length recommendations:

• Session ID: 16-32 random bytes
• API key: 24-32 bytes
• One-time token: 16+ bytes
• AES IV: 16 bytes (12 for GCM)

Format:

• Hex: easy to read, 2x size
• base64url: more compact, URL-safe
• Custom (with prefix): "user_abc123" for visual identification