Tokens here are generated with the Web Crypto API's getRandomValues, which draws from your operating system's cryptographically secure random number generator — the same class of source used to generate real API keys and session tokens, not the predictable pseudo-random sequence behind Math.random(). You can pick the output format, length, an optional prefix, and generate several tokens in one batch.
Yes, from a randomness standpoint — the Web Crypto API's random number generator is cryptographically secure and unpredictable, which is the property that matters for tokens. The one thing to be careful of is generating it on a device you trust and transmitting it only over a secure channel afterward.
Hex uses only 0-9 and a-f, so it's twice as long as the raw bytes but works anywhere. Base64 packs more entropy per character (shorter strings) but includes "+" and "/", which can cause problems in URLs — Base64URL swaps those for "-" and "_" so the token is safe to use directly in a URL or filename.
For most session tokens or API keys, 32 bytes (256 bits) of underlying randomness is a common, comfortably secure choice — going shorter starts to matter if the token protects something high-value, while going much longer mainly just adds length without meaningful extra security.