A new, more secure shape for npm access tokens

npm access tokens are getting a format upgrade. The change aligns npm with the authentication token pattern GitHub introduced earlier this year, and it addresses weaknesses in the old UUID-based tokens.

Previously, npm access tokens were 36-character UUIDs. That format made it difficult to reliably detect compromised tokens when scanning packages and repositories. The new format is designed to fix that by making tokens easier to identify and harder to guess.

What’s changing in the token format

New tokens now begin with a recognizable npm prefix. Because of that prefix, the tokens can be more effectively indexed by tools like GitHub secret scanning and npm’s internal secret scanners, which improves protection for your packages.

There are two other notable changes in the token construction:

  • The delimiter after the prefix is now an underscore (_) instead of a hyphen (-). Because the underscore is part of the token string, the entire token can be selected with a double-click.
  • The tokens are longer and draw from a larger alphabet, increasing entropy from 128 to 178 bits. Higher entropy means the tokens are less predictable and more resistant to guessing attacks.

In addition, the final six characters of each token are a CRC32 checksum encoded with Base62. This checksum helps reduce false positives when secret scanners search for leaked tokens.

The new format offers better protection against compromised tokens and more precise secret scanning. As a result, npm recommends that you move to the new format now by resetting your existing access tokens.

To do this, go to your npm Profile, select Access tokens, delete your old tokens, and create new ones.