diff --git a/services/tunnelbroker/src/Constants.h b/services/tunnelbroker/src/Constants.h
--- a/services/tunnelbroker/src/Constants.h
+++ b/services/tunnelbroker/src/Constants.h
@@ -40,6 +40,8 @@
 const int64_t AMQP_SHORTEST_RECONNECTION_ATTEMPT_INTERVAL = 1000 * 60; // 1 min
 
 // DeviceID
+// DEVICEID_CHAR_LENGTH has to be kept in sync with deviceIDCharLength
+// which is defined in web/utils/device-id.js
 const size_t DEVICEID_CHAR_LENGTH = 64;
 const std::regex DEVICEID_FORMAT_REGEX(
     "^(ks|mobile|web):[a-zA-Z0-9]{" + std::to_string(DEVICEID_CHAR_LENGTH) +
diff --git a/web/utils/device-id.js b/web/utils/device-id.js
new file mode 100644
--- /dev/null
+++ b/web/utils/device-id.js
@@ -0,0 +1,33 @@
+// @flow
+
+import invariant from 'invariant';
+
+import { generateRandomString } from './text-utils';
+
+const deviceIDTypes = Object.freeze({
+  KEYSERVER: 0,
+  WEB: 1,
+  MOBILE: 2,
+});
+type DeviceIDType = $Values<typeof deviceIDTypes>;
+
+const alphanumeric =
+  '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
+// deviceIDCharLength has to be kept in sync with DEVICEID_CHAR_LENGTH
+// which is defined in services/tunnelbroker/src/Constants.h
+const deviceIDCharLength = 64;
+
+function generateDeviceID(type: DeviceIDType): string {
+  const suffix = generateRandomString(deviceIDCharLength, alphanumeric);
+
+  if (type === deviceIDTypes.KEYSERVER) {
+    return `ks:${suffix}`;
+  } else if (type === deviceIDTypes.WEB) {
+    return `web:${suffix}`;
+  } else if (type === deviceIDTypes.MOBILE) {
+    return `mobile:${suffix}`;
+  }
+  invariant(false, `Unhandled device type ${type}`);
+}
+
+export { generateDeviceID, deviceIDCharLength, deviceIDTypes };
diff --git a/web/utils/device-id.test.js b/web/utils/device-id.test.js
new file mode 100644
--- /dev/null
+++ b/web/utils/device-id.test.js
@@ -0,0 +1,66 @@
+// @flow
+
+import {
+  generateDeviceID,
+  deviceIDCharLength,
+  deviceIDTypes,
+} from './device-id';
+
+describe('generateDeviceID', () => {
+  const baseRegExp = new RegExp(
+    `^(ks|mobile|web):[a-zA-Z0-9]{${deviceIDCharLength.toString()}}$`,
+  );
+  it(
+    'passed deviceIDTypes.KEYSERVER retruns a randomly generated string, ' +
+      'subject to ^(ks|mobile|web):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$',
+    () => {
+      expect(generateDeviceID(deviceIDTypes.KEYSERVER)).toMatch(baseRegExp);
+    },
+  );
+
+  it(
+    'passed deviceIDTypes.WEB retruns a randomly generated string, ' +
+      'subject to ^(ks|mobile|web):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$',
+    () => {
+      expect(generateDeviceID(deviceIDTypes.WEB)).toMatch(baseRegExp);
+    },
+  );
+
+  it(
+    'passed deviceIDTypes.MOBILE retruns a randomly generated string, ' +
+      'subject to ^(ks|mobile|web):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$',
+    () => {
+      expect(generateDeviceID(deviceIDTypes.MOBILE)).toMatch(baseRegExp);
+    },
+  );
+
+  it(
+    'passed deviceIDTypes.KEYSERVER retruns a randomly generated string, ' +
+      'subject to ^(ks):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$',
+    () => {
+      expect(generateDeviceID(deviceIDTypes.KEYSERVER)).toMatch(
+        new RegExp(`^(ks):[a-zA-Z0-9]{${deviceIDCharLength.toString()}}$`),
+      );
+    },
+  );
+
+  it(
+    'passed deviceIDTypes.WEB retruns a randomly generated string, ' +
+      'subject to ^(web):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$',
+    () => {
+      expect(generateDeviceID(deviceIDTypes.WEB)).toMatch(
+        new RegExp(`^(web):[a-zA-Z0-9]{${deviceIDCharLength.toString()}}$`),
+      );
+    },
+  );
+
+  it(
+    'passed deviceIDTypes.MOBILE retruns a randomly generated string, ' +
+      'subject to ^(mobile):[a-zA-Z0-9]{DEVICEID_CHAR_LENGTH}$',
+    () => {
+      expect(generateDeviceID(deviceIDTypes.MOBILE)).toMatch(
+        new RegExp(`^(mobile):[a-zA-Z0-9]{${deviceIDCharLength.toString()}}$`),
+      );
+    },
+  );
+});