diff --git a/core/src/main/java/de/ids_mannheim/korap/exceptions/StatusCodes.java b/core/src/main/java/de/ids_mannheim/korap/exceptions/StatusCodes.java
index d69dabd..a93dbc2 100644
--- a/core/src/main/java/de/ids_mannheim/korap/exceptions/StatusCodes.java
+++ b/core/src/main/java/de/ids_mannheim/korap/exceptions/StatusCodes.java
@@ -13,7 +13,7 @@
     /**
      * 100 status codes for standard system errors
      */
-    public static final int DEFAULT_ERROR = 100;
+    public static final int GENERAL_ERROR = 100;
     public static final int NO_RESULT_FOUND = 101;
     public static final int UNSUPPORTED_AUTHENTICATION_SCHEME = 102;
     public static final int UNSUPPORTED_OPERATION = 103;
@@ -24,6 +24,7 @@
     public static final int NOT_SUPPORTED = 108;
     public static final int NOT_ALLOWED = 109;
     public static final int HTTPS_REQUIRED = 110;
+    public static final int INVALID_ALGORITHM = 111;
 
     /**
      * 200 status codes general JSON serialization error
diff --git a/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java b/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java
index b11f8cf..fc86217 100644
--- a/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java
+++ b/full/src/main/java/de/ids_mannheim/korap/config/FullConfiguration.java
@@ -66,7 +66,9 @@
     private boolean isSoftDeleteGroup;
     private boolean isSoftDeleteGroupMember;
 
-    private EncryptionIface.Encryption encryption;
+    private EncryptionIface.Encryption secureHashAlgorithm;
+    private String secureRandomAlgorithm;
+    private String messageDigestAlgorithm;
 
     private AuthenticationMethod OAuth2passwordAuthentication;
     private String nativeClientHost;
@@ -103,14 +105,24 @@
         setMailConfiguration(properties);
         ldapConfig = properties.getProperty("ldap.config");
 
-        setEncryption(Enum.valueOf(EncryptionIface.Encryption.class,
-                properties.getProperty("security.encryption", "BCRYPT")));
-
+        setSecurityConfiguration(properties);
         setOAuth2Configuration(properties);
         setOpenIdConfiguration(properties);
         setRSAKeys(properties);
     }
 
+    private void setSecurityConfiguration (Properties properties) {
+        setSecureHashAlgorithm(Enum.valueOf(EncryptionIface.Encryption.class,
+                properties.getProperty("security.secure.hash.algorithm",
+                        "BCRYPT")));
+
+        setSecureRandomAlgorithm(properties
+                .getProperty("security.secure.random.algorithm", "SHA1PRNG"));
+
+        setMessageDigestAlgorithm(
+                properties.getProperty("security.md.algorithm", "MD5"));
+    }
+
     private void setOpenIdConfiguration (Properties properties)
             throws URISyntaxException, MalformedURLException {
         String issuerStr = properties.getProperty("security.jwt.issuer",
@@ -466,12 +478,13 @@
         this.emailAddressRetrieval = emailAddressRetrieval;
     }
 
-    public EncryptionIface.Encryption getEncryption () {
-        return encryption;
+    public EncryptionIface.Encryption getSecureHashAlgorithm () {
+        return secureHashAlgorithm;
     }
 
-    public void setEncryption (EncryptionIface.Encryption encryption) {
-        this.encryption = encryption;
+    public void setSecureHashAlgorithm (
+            EncryptionIface.Encryption secureHashAlgorithm) {
+        this.secureHashAlgorithm = secureHashAlgorithm;
     }
 
     public AuthenticationMethod getOAuth2passwordAuthentication () {
@@ -619,4 +632,20 @@
     public void setAuthorizationCodeExpiry (int authorizationCodeExpiry) {
         this.authorizationCodeExpiry = authorizationCodeExpiry;
     }
+
+    public String getSecureRandomAlgorithm () {
+        return secureRandomAlgorithm;
+    }
+
+    public void setSecureRandomAlgorithm (String secureRandomAlgorithm) {
+        this.secureRandomAlgorithm = secureRandomAlgorithm;
+    }
+
+    public String getMessageDigestAlgorithm () {
+        return messageDigestAlgorithm;
+    }
+
+    public void setMessageDigestAlgorithm (String messageDigestAlgorithm) {
+        this.messageDigestAlgorithm = messageDigestAlgorithm;
+    }
 }
diff --git a/full/src/main/java/de/ids_mannheim/korap/encryption/KustvaktEncryption.java b/full/src/main/java/de/ids_mannheim/korap/encryption/KustvaktEncryption.java
index 735546c..211e6e5 100644
--- a/full/src/main/java/de/ids_mannheim/korap/encryption/KustvaktEncryption.java
+++ b/full/src/main/java/de/ids_mannheim/korap/encryption/KustvaktEncryption.java
@@ -63,7 +63,7 @@
     @Override
     public String secureHash (String input, String salt) {
         String hashString = "";
-        switch (config.getEncryption()) {
+        switch (config.getSecureHashAlgorithm()) {
             case ESAPICYPHER:
                 break;
             case SIMPLE:
@@ -83,7 +83,7 @@
                 hashString = bcryptHash(input, salt);
                 break;
             default:
-                jlog.warn("Invalid value: "+ config.getEncryption());
+                jlog.warn("Invalid value: "+ config.getSecureHashAlgorithm());
                 break;
         }
         return hashString;
@@ -191,7 +191,7 @@
     @Override
     public boolean checkHash (String plain, String hash, String salt) {
         String pw = "";
-        switch (config.getEncryption()) {
+        switch (config.getSecureHashAlgorithm()) {
             case ESAPICYPHER:
                 pw = secureHash(plain, salt);
                 break;
@@ -212,7 +212,7 @@
 
     @Override
     public boolean checkHash (String plain, String hash) {
-        switch (config.getEncryption()) {
+        switch (config.getSecureHashAlgorithm()) {
             case ESAPICYPHER:
                 return secureHash(plain).equals(hash);
             case BCRYPT:
diff --git a/full/src/main/java/de/ids_mannheim/korap/encryption/RandomCodeGenerator.java b/full/src/main/java/de/ids_mannheim/korap/encryption/RandomCodeGenerator.java
new file mode 100644
index 0000000..e6b60ae
--- /dev/null
+++ b/full/src/main/java/de/ids_mannheim/korap/encryption/RandomCodeGenerator.java
@@ -0,0 +1,64 @@
+package de.ids_mannheim.korap.encryption;
+
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.util.UUID;
+
+import javax.annotation.PostConstruct;
+
+import org.apache.commons.codec.binary.Base64;
+import org.apache.commons.lang.ArrayUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import de.ids_mannheim.korap.config.FullConfiguration;
+import de.ids_mannheim.korap.exceptions.KustvaktException;
+import de.ids_mannheim.korap.exceptions.StatusCodes;
+
+/**
+ * Generates a random string that can be used for tokens, client id,
+ * client secret, etc.
+ * 
+ * @author margaretha
+ *
+ */
+@Component
+public class RandomCodeGenerator {
+
+    @Autowired
+    private FullConfiguration config;
+
+    public static SecureRandom secureRandom;
+
+    @PostConstruct
+    public void init () throws NoSuchAlgorithmException {
+        secureRandom =
+                SecureRandom.getInstance(config.getSecureRandomAlgorithm());
+    }
+
+    public String createRandomCode () throws KustvaktException {
+        UUID randomUUID = UUID.randomUUID();
+        byte[] uuidBytes = randomUUID.toString().getBytes();
+        byte[] secureBytes = new byte[3];
+        secureRandom.nextBytes(secureBytes);
+
+        byte[] bytes = ArrayUtils.addAll(uuidBytes, secureBytes);
+
+        try {
+            MessageDigest md = MessageDigest
+                    .getInstance(config.getMessageDigestAlgorithm());
+            md.update(bytes);
+            byte[] digest = md.digest();
+            String code = Base64.encodeBase64String(digest);
+            md.reset();
+            return code;
+        }
+        catch (NoSuchAlgorithmException e) {
+            throw new KustvaktException(StatusCodes.INVALID_ALGORITHM,
+                    config.getMessageDigestAlgorithm()
+                            + "is not a valid MessageDigest algorithm");
+        }
+    }
+
+}
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/service/OltuAuthorizationService.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/service/OltuAuthorizationService.java
index b05ed06..cff1ce2 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/service/OltuAuthorizationService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/service/OltuAuthorizationService.java
@@ -1,13 +1,13 @@
 package de.ids_mannheim.korap.oauth2.oltu.service;
 
+import java.io.UnsupportedEncodingException;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.net.URLEncoder;
 import java.time.ZonedDateTime;
 
 import javax.servlet.http.HttpServletRequest;
 
-import org.apache.commons.codec.binary.Base64;
-import org.apache.oltu.oauth2.as.issuer.OAuthIssuer;
 import org.apache.oltu.oauth2.as.request.OAuthAuthzRequest;
 import org.apache.oltu.oauth2.as.response.OAuthASResponse;
 import org.apache.oltu.oauth2.common.exception.OAuthSystemException;
@@ -17,6 +17,7 @@
 
 import com.sun.jersey.api.client.ClientResponse.Status;
 
+import de.ids_mannheim.korap.encryption.RandomCodeGenerator;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.oauth2.constant.OAuth2Error;
@@ -33,7 +34,7 @@
 public class OltuAuthorizationService extends OAuth2AuthorizationService {
 
     @Autowired
-    private OAuthIssuer oauthIssuer;
+    private RandomCodeGenerator codeGenerator;
 
     /**
      * Authorization code request does not require client
@@ -57,8 +58,8 @@
         String clientId = authzRequest.getClientId();
         OAuth2Client client = clientService.authenticateClientId(clientId);
 
-        String redirectUri = authzRequest.getRedirectURI();
-        String verifiedRedirectUri = verifyRedirectUri(client, redirectUri);
+        String redirectUriStr = authzRequest.getRedirectURI();
+        String verifiedRedirectUri = verifyRedirectUri(client, redirectUriStr);
 
         URI redirectURI;
         try {
@@ -72,18 +73,21 @@
         String scope, code;
         try {
             checkResponseType(authzRequest.getResponseType());
-
-            code = oauthIssuer.authorizationCode();
-//            code = Base64.encodeBase64String(code.getBytes());
-            
+            code = URLEncoder.encode(codeGenerator.createRandomCode(), "UTF-8");
             scope = createAuthorization(username, authzRequest.getClientId(),
-                    redirectUri, authzRequest.getScopes(), code,
+                    redirectUriStr, authzRequest.getScopes(), code,
                     authenticationTime, null);
         }
         catch (KustvaktException e) {
             e.setRedirectUri(redirectURI);
             throw e;
         }
+        catch (UnsupportedEncodingException e) {
+            KustvaktException ke = new KustvaktException(
+                    StatusCodes.GENERAL_ERROR, e.getMessage());
+            ke.setRedirectUri(redirectURI);
+            throw ke;
+        }
 
         OAuthResponse oAuthResponse;
         try {
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/service/OltuTokenService.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/service/OltuTokenService.java
index e8ad63b..c9b574d 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/service/OltuTokenService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/oltu/service/OltuTokenService.java
@@ -6,8 +6,6 @@
 
 import javax.ws.rs.core.Response.Status;
 
-import org.apache.commons.codec.binary.Base64;
-import org.apache.oltu.oauth2.as.issuer.OAuthIssuer;
 import org.apache.oltu.oauth2.as.request.AbstractOAuthTokenRequest;
 import org.apache.oltu.oauth2.as.response.OAuthASResponse;
 import org.apache.oltu.oauth2.common.exception.OAuthSystemException;
@@ -18,6 +16,7 @@
 import org.springframework.stereotype.Service;
 
 import de.ids_mannheim.korap.config.Attributes;
+import de.ids_mannheim.korap.encryption.RandomCodeGenerator;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.oauth2.constant.OAuth2Error;
@@ -30,10 +29,10 @@
 
 @Service
 public class OltuTokenService extends OAuth2TokenService {
-
+    
     @Autowired
-    private OAuthIssuer oauthIssuer;
-
+    private RandomCodeGenerator randomGenerator; 
+    
     @Autowired
     private AccessTokenDao tokenDao;
 
@@ -281,11 +280,8 @@
             ZonedDateTime authenticationTime)
             throws OAuthSystemException, KustvaktException {
 
-        String accessToken = oauthIssuer.accessToken();
-//        accessToken = Base64.encodeBase64String(accessToken.getBytes());
-
-        String refreshToken = oauthIssuer.refreshToken();
-//        refreshToken = Base64.encodeBase64String(refreshToken.getBytes());
+        String accessToken = randomGenerator.createRandomCode();
+        String refreshToken = randomGenerator.createRandomCode();
 
         tokenDao.storeAccessToken(accessToken, refreshToken, accessScopes,
                 userId, clientId, authenticationTime);
diff --git a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java
index 6d61e02..8b3a639 100644
--- a/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java
+++ b/full/src/main/java/de/ids_mannheim/korap/oauth2/service/OAuth2ClientService.java
@@ -13,6 +13,7 @@
 import de.ids_mannheim.korap.config.FullConfiguration;
 import de.ids_mannheim.korap.dao.AdminDao;
 import de.ids_mannheim.korap.dto.OAuth2ClientDto;
+import de.ids_mannheim.korap.encryption.RandomCodeGenerator;
 import de.ids_mannheim.korap.exceptions.KustvaktException;
 import de.ids_mannheim.korap.exceptions.StatusCodes;
 import de.ids_mannheim.korap.interfaces.EncryptionIface;
@@ -53,6 +54,8 @@
     @Autowired
     private EncryptionIface encryption;
     @Autowired
+    private RandomCodeGenerator codeGenerator;
+    @Autowired
     private FullConfiguration config;
 
     public OAuth2ClientDto registerClient (OAuth2ClientJson clientJson,
@@ -91,12 +94,12 @@
             // installation of a native application client on a
             // specific device.
 
-            secret = encryption.createToken();
+            secret = codeGenerator.createRandomCode();
             secretHashcode = encryption.secureHash(secret,
                     config.getPasscodeSaltField());
         }
 
-        String id = encryption.createRandomNumber();
+        String id = codeGenerator.createRandomCode();
         try {
             clientDao.registerClient(id, secretHashcode, clientJson.getName(),
                     clientJson.getType(), isNative, url, urlHashCode,
diff --git a/full/src/main/resources/kustvakt.conf b/full/src/main/resources/kustvakt.conf
index 0c21e43..22e7e14 100644
--- a/full/src/main/resources/kustvakt.conf
+++ b/full/src/main/resources/kustvakt.conf
@@ -65,7 +65,16 @@
 security.tokenTTL=72H
 security.shortTokenTTL=45M
 
-## specifies the user data field that is used to salt user passwords
+## see SecureRandom Number Generation Algorithms
+## default SHA1PRNG
+security.secure.random.algorithm=SHA1PRNG
+
+## see MessageDigest Algorithms
+## default MD5
+security.md.algoritm = SHA-256  
+
+### secure hash support: BCRYPT, ESAPICYPHER
+security.secure.hash.algorithm=BCRYPT
 security.passcode.salt=salt
 
 security.idleTimeoutDuration = 25M
@@ -76,7 +85,6 @@
 security.encryption.loadFactor = 8
 security.validation.stringLength = 150
 security.validation.emailLength = 50
-security.encryption.algo=BCRYPT
 security.sharedSecret=this-is-shared-secret-code-for-JWT-Signing.It-must-contains-minimum-256-bits
 security.adminToken=adminToken
 
diff --git a/full/src/test/resources/kustvakt-test.conf b/full/src/test/resources/kustvakt-test.conf
index cc53e79..694abce 100644
--- a/full/src/test/resources/kustvakt-test.conf
+++ b/full/src/test/resources/kustvakt-test.conf
@@ -89,7 +89,16 @@
 security.tokenTTL = 2S
 security.shortTokenTTL = 1S
 
-## specifies the user data field that is used to salt user passwords
+## see SecureRandom Number Generation Algorithms
+## default SHA1PRNG
+security.secure.random.algorithm=SHA1PRNG
+
+## see MessageDigest Algorithms
+## default MD5
+security.md.algoritm = SHA-256  
+
+### secure hash support: BCRYPT, ESAPICYPHER
+security.secure.hash.algorithm=BCRYPT
 security.passcode.salt=salt
 
 security.idleTimeoutDuration = 25M
@@ -100,7 +109,7 @@
 security.encryption.loadFactor = 8
 security.validation.stringLength = 150
 security.validation.emailLength = 50
-security.encryption.algo=BCRYPT
+
 security.sharedSecret=this-is-shared-secret-code-for-JWT-Signing.It-must-contains-minimum-256-bits
 
 ## applicable: rewrite, foundry, filter, deny