diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 1b12c49018..23621fcfd0 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -3081,6 +3081,7 @@ virRandomBits;
 virRandomBytes;
 virRandomGenerateWWN;
 virRandomInt;
+virRandomToken;
 
 
 # util/virresctrl.h
diff --git a/src/util/virrandom.c b/src/util/virrandom.c
index 3ae1297e6b..c3f3aa1fa6 100644
--- a/src/util/virrandom.c
+++ b/src/util/virrandom.c
@@ -161,3 +161,21 @@ virRandomGenerateWWN(char **wwn,
                            (unsigned long long)virRandomBits(36));
     return 0;
 }
+
+char *virRandomToken(size_t len)
+{
+    g_autofree unsigned char *data = g_new0(unsigned char, len);
+    g_autofree char *token = g_new0(char, (len * 2) + 1);
+    static const char hex[] = "0123456789abcdef";
+    size_t i;
+
+    if (virRandomBytes(data, len) < 0)
+        return NULL;
+
+    for (i = 0; i < len; i++) {
+        token[(i*2)] = hex[data[i] & 0xf];
+        token[(i*2)+1] = hex[(data[i] >> 4) & 0xf];
+    }
+
+    return g_steal_pointer(&token);
+}
diff --git a/src/util/virrandom.h b/src/util/virrandom.h
index 297721f912..aac684ada9 100644
--- a/src/util/virrandom.h
+++ b/src/util/virrandom.h
@@ -26,3 +26,4 @@ uint32_t virRandomInt(uint32_t max);
 int virRandomBytes(unsigned char *buf, size_t buflen)
     ATTRIBUTE_NONNULL(1) G_GNUC_WARN_UNUSED_RESULT G_GNUC_NO_INLINE;
 int virRandomGenerateWWN(char **wwn, const char *virt_type) G_GNUC_NO_INLINE;
+char *virRandomToken(size_t len);