How should I store and manage tokens securely?

Store tokens encrypted at rest, transmit over HTTPS only, use secure HTTP headers (HttpOnly, Secure, SameSite), implement proper expiration and rotation, log access without exposing token values, and follow the principle of least privilege for token permissions.

JavaScript Token Generator:

class SecureTokenGenerator {
  constructor() {
    this.formats = {
      hex: '0123456789abcdef',
      base64: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/',
      base64url: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_',
      alphanumeric: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789',
      numeric: '0123456789',
      alpha: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz',
      symbols: '!@#$%^&*()_+-=[]{}|;:,.<>?'
    };
    
    this.presets = {
      apiKey: { length: 64, format: 'base64url', prefix: 'sk_' },
      sessionToken: { length: 43, format: 'base64url', prefix: 'sess_' },
      csrfToken: { length: 32, format: 'hex', prefix: 'csrf_' },
      bearerToken: { length: 40, format: 'base64url', prefix: 'bt_' },
      refreshToken: { length: 64, format: 'base64url', prefix: 'rt_' },
      nonce: { length: 32, format: 'hex', prefix: '' },
      deviceId: { length: 16, format: 'alphanumeric', prefix: 'dev_' },
      recoveryCode: { length: 12, format: 'alphanumeric', prefix: '' }
    };
  }
  
  // Generate secure random token
  generateToken(options = {}) {
    try {
      const config = {
        length: options.length || 32,
        format: options.format || 'base64url',
        prefix: options.prefix || '',
        suffix: options.suffix || '',
        separator: options.separator || '',
        chunks: options.chunks || 1,
        chunkSize: options.chunkSize || null,
        includeTimestamp: options.includeTimestamp || false,
        includeChecksum: options.includeChecksum || false
      };
      
      const startTime = performance.now();
      
      // Validate configuration
      const validation = this.validateConfig(config);
      if (!validation.valid) {
        return {
          success: false,
          error: validation.error
        };
      }
      
      // Generate random bytes
      const randomBytes = this.generateSecureRandomBytes(config.length);
      
      // Convert to specified format
      let token = this.formatToken(randomBytes, config.format);
      
      // Apply chunking if requested
      if (config.chunks > 1 || config.chunkSize) {
        token = this.chunkToken(token, config.chunks, config.chunkSize, config.separator);
      }
      
      // Add prefix and suffix
      const finalToken = config.prefix + token + config.suffix;
      
      // Add timestamp if requested
      let timestampedToken = finalToken;
      let timestamp = null;
      if (config.includeTimestamp) {
        timestamp = Date.now().toString(36);
        timestampedToken = finalToken + '_' + timestamp;
      }
      
      // Add checksum if requested
      let finalResult = timestampedToken;
      let checksum = null;
      if (config.includeChecksum) {
        checksum = await this.generateChecksum(timestampedToken);
        finalResult = timestampedToken + '_' + checksum;
      }
      
      const endTime = performance.now();
      
      // Calculate entropy and security metrics
      const security = this.calculateSecurity(config.length, config.format);
      
      return {
        success: true,
        token: finalResult,
        rawToken: token,
        config: config,
        security: security,
        metadata: {
          length: finalResult.length,
          rawLength: token.length,
          entropy: security.entropy,
          format: config.format,
          prefix: config.prefix,
          suffix: config.suffix,
          timestamp: timestamp,
          checksum: checksum,
          chunks: config.chunks
        },
        timing: {
          duration: Math.round(endTime - startTime),
          formatted: `${Math.round(endTime - startTime)}ms`
        }
      };
      
    } catch (error) {
      return {
        success: false,
        error: error.message
      };
    }
  }
  
  // Generate token using preset configuration
  generatePresetToken(preset, customOptions = {}) {
    if (!this.presets[preset]) {
      return {
        success: false,
        error: `Unknown preset: ${preset}. Available presets: ${Object.keys(this.presets).join(', ')}`
      };
    }
    
    const presetConfig = { ...this.presets[preset], ...customOptions };
    return this.generateToken(presetConfig);
  }
  
  // Generate multiple tokens
  generateMultipleTokens(count, options = {}) {
    const results = [];
    const startTime = performance.now();
    
    for (let i = 0; i < count; i++) {
      const result = this.generateToken({
        ...options,
        prefix: options.prefix ? `${options.prefix}${i + 1}_` : options.prefix
      });
      
      results.push({
        index: i + 1,
        ...result
      });
    }
    
    const endTime = performance.now();
    const successful = results.filter(r => r.success);
    
    return {
      success: successful.length > 0,
      count: count,
      successful: successful.length,
      failed: count - successful.length,
      results: results,
      timing: {
        total: Math.round(endTime - startTime),
        average: successful.length > 0 ? Math.round((endTime - startTime) / successful.length) : 0,
        formatted: `${Math.round(endTime - startTime)}ms total`
      },
      summary: this.generateBatchSummary(results)
    };
  }
  
  // Validate token configuration
  validateConfig(config) {
    if (config.length < 8) {
      return { valid: false, error: 'Token length must be at least 8 characters' };
    }
    
    if (config.length > 1024) {
      return { valid: false, error: 'Token length cannot exceed 1024 characters' };
    }
    
    if (!this.formats[config.format]) {
      return { valid: false, error: `Unknown format: ${config.format}` };
    }
    
    if (config.chunks < 1) {
      return { valid: false, error: 'Chunks must be at least 1' };
    }
    
    return { valid: true };
  }
  
  // Generate cryptographically secure random bytes
  generateSecureRandomBytes(length) {
    if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
      // Browser environment
      const array = new Uint8Array(length);
      crypto.getRandomValues(array);
      return Array.from(array);
    } else if (typeof require !== 'undefined') {
      // Node.js environment
      const crypto = require('crypto');
      return Array.from(crypto.randomBytes(length));
    } else {
      // Fallback (not cryptographically secure)
      console.warn('Using fallback random generation - not cryptographically secure');
      const array = new Array(length);
      for (let i = 0; i < length; i++) {
        array[i] = Math.floor(Math.random() * 256);
      }
      return array;
    }
  }
  
  // Format token according to specified format
  formatToken(bytes, format) {
    const charset = this.formats[format];
    if (!charset) {
      throw new Error(`Unknown format: ${format}`);
    }
    
    switch (format) {
      case 'hex':
        return bytes.map(b => b.toString(16).padStart(2, '0')).join('');
        
      case 'base64':
        return this.bytesToBase64(bytes);
        
      case 'base64url':
        return this.bytesToBase64Url(bytes);
        
      default:
        // Custom character set
        let result = '';
        for (const byte of bytes) {
          result += charset[byte % charset.length];
        }
        return result;
    }
  }
  
  // Convert bytes to Base64
  bytesToBase64(bytes) {
    const binary = String.fromCharCode(...bytes);
    return btoa(binary);
  }
  
  // Convert bytes to Base64 URL-safe
  bytesToBase64Url(bytes) {
    return this.bytesToBase64(bytes)
      .replace(/\+/g, '-')
      .replace(/\//g, '_')
      .replace(/=/g, '');
  }
  
  // Chunk token into smaller parts
  chunkToken(token, chunks, chunkSize, separator) {
    if (chunkSize) {
      // Split by fixed chunk size
      const parts = [];
      for (let i = 0; i < token.length; i += chunkSize) {
        parts.push(token.substr(i, chunkSize));
      }
      return parts.join(separator || '-');
    } else {
      // Split into specified number of chunks
      const chunkLength = Math.ceil(token.length / chunks);
      const parts = [];
      for (let i = 0; i < chunks; i++) {
        const start = i * chunkLength;
        const end = start + chunkLength;
        parts.push(token.substr(start, end));
      }
      return parts.join(separator || '-');
    }
  }
  
  // Generate checksum for token
  async generateChecksum(token) {
    if (typeof crypto !== 'undefined' && crypto.subtle) {
      const encoder = new TextEncoder();
      const data = encoder.encode(token);
      const hashBuffer = await crypto.subtle.digest('SHA-256', data);
      const hashArray = Array.from(new Uint8Array(hashBuffer));
      return hashArray.slice(0, 4).map(b => b.toString(16).padStart(2, '0')).join('');
    } else {
      // Simple checksum fallback
      let sum = 0;
      for (let i = 0; i < token.length; i++) {
        sum += token.charCodeAt(i);
      }
      return (sum % 65536).toString(16).padStart(4, '0');
    }
  }
  
  // Calculate security metrics
  calculateSecurity(length, format) {
    const charset = this.formats[format];
    const bitsPerCharacter = Math.log2(charset.length);
    const entropy = length * bitsPerCharacter;
    
    // Estimate time to crack (assuming 1 billion attempts per second)
    const possibleValues = Math.pow(charset.length, length);
    const secondsToCrack = possibleValues / (2 * 1e9); // Average case
    
    return {
      entropy: Math.round(entropy * 100) / 100,
      bitsPerCharacter: Math.round(bitsPerCharacter * 100) / 100,
      possibleValues: possibleValues.toExponential(2),
      timeToCrack: this.formatTime(secondsToCrack),
      securityLevel: this.getSecurityLevel(entropy),
      charsetSize: charset.length
    };
  }
  
  // Get security level based on entropy
  getSecurityLevel(entropy) {
    if (entropy >= 256) return { level: 'Excellent', description: 'Military-grade security' };
    if (entropy >= 128) return { level: 'Very Strong', description: 'Cryptographically secure' };
    if (entropy >= 80) return { level: 'Strong', description: 'Good for most applications' };
    if (entropy >= 64) return { level: 'Moderate', description: 'Acceptable for low-risk uses' };
    if (entropy >= 40) return { level: 'Weak', description: 'Vulnerable to attacks' };
    return { level: 'Very Weak', description: 'Easily crackable' };
  }
  
  // Format time duration
  formatTime(seconds) {
    if (seconds < 1) return 'Less than 1 second';
    if (seconds < 60) return `${Math.round(seconds)} seconds`;
    if (seconds < 3600) return `${Math.round(seconds / 60)} minutes`;
    if (seconds < 86400) return `${Math.round(seconds / 3600)} hours`;
    if (seconds < 2592000) return `${Math.round(seconds / 86400)} days`;
    if (seconds < 31557600) return `${Math.round(seconds / 2592000)} months`;
    if (seconds < 315576000000) return `${Math.round(seconds / 31557600)} years`;
    return 'Effectively impossible';
  }
  
  // Validate existing token
  validateToken(token, options = {}) {
    try {
      const analysis = {
        isValid: true,
        length: token.length,
        format: 'unknown',
        hasPrefix: false,
        hasSuffix: false,
        hasTimestamp: false,
        hasChecksum: false,
        issues: []
      };
      
      // Check for common prefixes
      const prefixes = Object.values(this.presets).map(p => p.prefix).filter(p => p);
      for (const prefix of prefixes) {
        if (token.startsWith(prefix)) {
          analysis.hasPrefix = true;
          analysis.detectedPrefix = prefix;
          break;
        }
      }
      
      // Detect format based on characters
      const tokenBody = analysis.hasPrefix ? 
        token.substring(analysis.detectedPrefix?.length || 0) : token;
      
      if (/^[0-9a-f]+$/i.test(tokenBody)) {
        analysis.format = 'hex';
      } else if (/^[A-Za-z0-9+/]+=*$/.test(tokenBody)) {
        analysis.format = 'base64';
      } else if (/^[A-Za-z0-9_-]+$/.test(tokenBody)) {
        analysis.format = 'base64url';
      } else if (/^[A-Za-z0-9]+$/.test(tokenBody)) {
        analysis.format = 'alphanumeric';
      }
      
      // Check length recommendations
      if (token.length < 16) {
        analysis.issues.push('Token is shorter than recommended minimum (16 characters)');
      }
      
      if (token.length < 32) {
        analysis.issues.push('Token may be vulnerable to brute force attacks');
      }
      
      // Calculate entropy
      const security = this.calculateSecurity(tokenBody.length, analysis.format);
      analysis.security = security;
      
      if (security.entropy < 80) {
        analysis.issues.push('Token has insufficient entropy for secure applications');
        analysis.isValid = false;
      }
      
      return {
        success: true,
        token: token,
        analysis: analysis
      };
      
    } catch (error) {
      return {
        success: false,
        error: error.message
      };
    }
  }
  
  // Generate token set for different purposes
  generateTokenSet() {
    const tokenSet = {};
    const errors = [];
    
    for (const [name, config] of Object.entries(this.presets)) {
      try {
        const result = this.generatePresetToken(name);
        if (result.success) {
          tokenSet[name] = result.token;
        } else {
          errors.push(`${name}: ${result.error}`);
        }
      } catch (error) {
        errors.push(`${name}: ${error.message}`);
      }
    }
    
    return {
      success: Object.keys(tokenSet).length > 0,
      tokens: tokenSet,
      errors: errors,
      count: Object.keys(tokenSet).length
    };
  }
  
  // Generate batch summary
  generateBatchSummary(results) {
    const successful = results.filter(r => r.success);
    const formats = {};
    const totalEntropy = successful.reduce((sum, r) => sum + (r.security?.entropy || 0), 0);
    
    successful.forEach(result => {
      const format = result.config?.format || 'unknown';
      formats[format] = (formats[format] || 0) + 1;
    });
    
    return {
      successful: successful.length,
      failed: results.length - successful.length,
      formats: formats,
      averageEntropy: successful.length > 0 ? Math.round(totalEntropy / successful.length) : 0,
      averageLength: successful.length > 0 ? 
        Math.round(successful.reduce((sum, r) => sum + (r.token?.length || 0), 0) / successful.length) : 0
    };
  }
}

// Usage examples
const tokenGen = new SecureTokenGenerator();

// Generate different types of tokens
console.log('Generate API Key:');
const apiKey = tokenGen.generatePresetToken('apiKey');
console.log(apiKey);

console.log('\nGenerate Session Token:');
const sessionToken = tokenGen.generatePresetToken('sessionToken');
console.log(sessionToken);

console.log('\nGenerate Custom Token:');
const customToken = tokenGen.generateToken({
  length: 48,
  format: 'base64url',
  prefix: 'custom_',
  chunks: 3,
  separator: '-',
  includeTimestamp: true
});
console.log(customToken);

// Generate multiple tokens
console.log('\nGenerate Multiple Tokens:');
const multipleTokens = tokenGen.generateMultipleTokens(5, {
  length: 32,
  format: 'hex',
  prefix: 'token_'
});
console.log('Multiple tokens result:', multipleTokens.summary);

// Validate token
console.log('\nValidate Token:');
if (apiKey.success) {
  const validation = tokenGen.validateToken(apiKey.token);
  console.log('Validation result:', validation);
}

// Generate complete token set
console.log('
Generate Token Set:');
const tokenSet = tokenGen.generateTokenSet();
console.log('Token set result:', tokenSet);

console.log('Secure token generator ready!');