Hello i want to know if this auth token is secure enough for a site of millions of logged in users:


With 10 million connected users how much hard is to guess a valid token?

Which features should it have? Consider that the content of the cookie travels up and down the server to each request so it can't be too easy

It is safe to set this cookie via HTTPS but read it in each HTTP page?

1 Answer 1


So here's how this works: we tend to consider 128 bits of random data unguessable. See Why so long to break 128-bit encryption? for some talk about that.

What you want to do is calculate the birthday attack. There are some other questions talking about this in What are the chances to generate the same ssh key? and What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data?.

Your token there looks like it's Base64 encoded, so it provides 6 bits per character. That's over 3,000 bits of data. Encode something smaller (128 bits raw, 170+ in B64) and save yourself the bandwidth.

For the second part of your question, see How is an HTTPS login secure when pages use HTTP?.

  • Truncated Base64 of some sort, at least.
    – Steve
    May 31, 2013 at 20:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .