Tokens that cannot be guessed
Password reset links, email verification links, invitations and session IDs all depend on a token that an attacker cannot guess. OWASP asks for at least 64 bits of entropy in session IDs, and more is better. This generator defaults to 256 bits, written in Base64url so the token is safe in URLs and cookies without escaping.
Handling tokens on the server
- Store a SHA-256 hash of each token rather than the token itself, and look tokens up by hash.
- Give tokens a short lifetime: about an hour for password resets, a day or two for email verification.
- Make single-use tokens invalid the moment they are used.
Frequently asked questions
What is the difference between Base64 and Base64url?
Base64url replaces + and / with – and _, and drops the = padding, so the token can go in a URL or file name without encoding.
Is 128 bits enough?
Yes, 128 bits cannot be guessed. 256 bits is the default because it costs nothing extra.