diff --git a/services/tunnelbroker/src/Constants.h b/services/tunnelbroker/src/Constants.h
--- a/services/tunnelbroker/src/Constants.h
+++ b/services/tunnelbroker/src/Constants.h
@@ -40,6 +40,8 @@
 const int64_t AMQP_SHORTEST_RECONNECTION_ATTEMPT_INTERVAL = 1000 * 60; // 1 min
 
 // DeviceID
+// DEVICEID_CHAR_LENGTH has to be kept in sync with deviceIDCharLength
+// deviceIDCharLength is defined in web/utils/device-id.js
 const size_t DEVICEID_CHAR_LENGTH = 64;
 const std::regex DEVICEID_FORMAT_REGEX(
     "^(ks|mobile|web):[a-zA-Z0-9]{" + std::to_string(DEVICEID_CHAR_LENGTH) +
diff --git a/web/utils/device-id.js b/web/utils/device-id.js
new file mode 100644
--- /dev/null
+++ b/web/utils/device-id.js
@@ -0,0 +1,30 @@
+// @flow
+import { generateRandomString } from './text-utils';
+
+const deviceIDTypes = Object.freeze({
+  KEYSERVER: 0,
+  WEB: 1,
+  MOBILE: 2,
+});
+type DeviceIDType = $Values<typeof deviceIDTypes>;
+
+const alphanumeric =
+  '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
+// deviceIDCharLength has to be kept in sync with DEVICEID_CHAR_LENGTH
+// DEVICEID_CHAR_LENGTH is defined in services/tunnelbroker/src/Constants.h
+const deviceIDCharLength = 64;
+
+function generateDeviceID(type: DeviceIDType): string {
+  const suffix = generateRandomString(deviceIDCharLength, alphanumeric);
+
+  if (type === deviceIDTypes.KEYSERVER) {
+    return `ks:${suffix}`;
+  } else if (type === deviceIDTypes.WEB) {
+    return `web:${suffix}`;
+  } else if (type === deviceIDTypes.MOBILE) {
+    return `mobile:${suffix}`;
+  }
+  throw 'generateDeviceID: wrong argument. Must be one of: deviceIDTypes.KEYSERVER, deviceIDTypes.WEB, deviceIDTypes.MOBILE';
+}
+
+export { generateDeviceID, deviceIDCharLength, deviceIDTypes };
diff --git a/web/utils/device-id.test.js b/web/utils/device-id.test.js
new file mode 100644
--- /dev/null
+++ b/web/utils/device-id.test.js
@@ -0,0 +1,53 @@
+// @flow
+
+import {
+  generateDeviceID,
+  deviceIDCharLength,
+  deviceIDTypes,
+} from './device-id';
+
+describe('generateDeviceID', () => {
+  it('passed 0 retruns a randomly generated string, subject to ^(ks|mobile|web):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$', () => {
+    expect(generateDeviceID(deviceIDTypes.KEYSERVER)).toMatch(
+      new RegExp(
+        '^(ks|mobile|web):[a-zA-Z0-9]{' + deviceIDCharLength.toString() + '}$',
+      ),
+    );
+  });
+
+  it('passed 1 retruns a randomly generated string, subject to ^(ks|mobile|web):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$', () => {
+    expect(generateDeviceID(deviceIDTypes.WEB)).toMatch(
+      new RegExp(
+        '^(ks|mobile|web):[a-zA-Z0-9]{' + deviceIDCharLength.toString() + '}$',
+      ),
+    );
+  });
+
+  it('passed 2 retruns a randomly generated string, subject to ^(ks|mobile|web):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$', () => {
+    expect(generateDeviceID(deviceIDTypes.MOBILE)).toMatch(
+      new RegExp(
+        '^(ks|mobile|web):[a-zA-Z0-9]{' + deviceIDCharLength.toString() + '}$',
+      ),
+    );
+  });
+
+  it('passed 0 retruns a randomly generated string, subject to ^(ks):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$', () => {
+    expect(generateDeviceID(deviceIDTypes.KEYSERVER)).toMatch(
+      new RegExp('^(ks):[a-zA-Z0-9]{' + deviceIDCharLength.toString() + '}$'),
+    );
+  });
+
+  it('passed 1 retruns a randomly generated string, subject to ^(web):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$', () => {
+    expect(generateDeviceID(deviceIDTypes.WEB)).toMatch(
+      new RegExp('^(web):[a-zA-Z0-9]{' + deviceIDCharLength.toString() + '}$'),
+    );
+  });
+
+  it('passed 2 retruns a randomly generated string, subject to ^(mobile):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$', () => {
+    expect(generateDeviceID(deviceIDTypes.MOBILE)).toMatch(
+      new RegExp(
+        '^(mobile):[a-zA-Z0-9]{' + deviceIDCharLength.toString() + '}$',
+      ),
+    );
+  });
+});