All lessons T
Security Hygiene beginner 8 min

Generate Random Tokens for Safe Test Fixtures

Create local-only fixture tokens that look realistic without copying real secrets.

Scenario

The test suite needs API keys that look real — tk_test_ prefix, 32 characters, right charset — so parsers and validators exercise the same code paths as production. The tempting shortcut is grabbing a real key "just for the fixture," and that shortcut is how live credentials end up in git history, CI logs, and eventually a secret scanner report. Generate shaped fakes instead; realism of format requires zero realism of value.

Broken input

Need 6 fake API keys, prefix tk_test_, 32 chars each

Goal

Use Random String to generate six random strings at the right length and charset, then attach the tk_test_ prefix — fixtures that satisfy every format check while containing no secret material.

Tool sequence

  1. Open Random String.
  2. Set length to 32 with the alphanumeric charset the real keys use, and generate six values in one batch.
  3. Prepend tk_test_ to each — keeping the well-known test prefix visible is itself a safety feature; anyone reading the fixture knows instantly it is fake.
  4. Drop the tokens into the fixture file with a comment marking them as generated test values.
  5. Where fixtures also need entity IDs, use UUID Generator for those instead — IDs and secrets have different shapes, and tests should notice if they get swapped.

Checkpoint output

tk_test_8fKq2LmN9xVw4RtY7uPa3sHd6gJb0cZe
tk_test_1aBc5DeF8gHi2JkL6mNo9pQr4sTu7vWx
... (6 total, all prefixed, all 32 chars after the prefix, no real key material)

Six format-valid, provably fake keys — parsers and validators behave as they would in production, and a leak of this file leaks nothing.

Common mistakes

  • Copying a real token into a fixture because it already has the right shape — the fixture outlives the test and the repo outlives the fixture.
  • Using random strings where the test asserts on exact values; snapshot tests need deterministic fixtures, not fresh randomness per run.
  • Dropping the test marker from the prefix, leaving future readers unable to tell fake from leaked.
  • Generating fixtures that accidentally match production key length and prefix exactly, so secret scanners flag every CI run.

Related tools and lessons