diff --git a/packages/core/src/options.ts b/packages/core/src/options.ts
index 29f107a0..7661267e 100644
--- a/packages/core/src/options.ts
+++ b/packages/core/src/options.ts
@@ -8,6 +8,7 @@ import type {
   SavedSessionOptions,
   MathjaxOptions,
 } from './types';
+import { shortId } from './utils';
 
 export function makeBinderOptions(opts: BinderOptions) {
   return {
@@ -36,12 +37,15 @@ export function makeKernelOptions(opts: KernelOptions): Required<KernelOptions>
 }
 
 export function makeServerSettings(settings: ServerSettings): Required<ServerSettings> {
+  const baseUrl = settings.baseUrl ?? 'http://localhost:8888';
+  const wsUrl = settings.wsUrl ?? baseUrl.replace(/^http/, 'ws');
+
   return {
-    baseUrl: 'http://localhost:8888',
-    token: 'test-secret',
+    token: shortId(), // randomized default token to prevent accidental access to a local server
     appendToken: true,
-    wsUrl: 'ws://localhost:8888',
     ...settings,
+    wsUrl,
+    baseUrl,
   };
 }
 
diff --git a/packages/core/tests/config.spec.ts b/packages/core/tests/config.spec.ts
index 864eb689..36151556 100644
--- a/packages/core/tests/config.spec.ts
+++ b/packages/core/tests/config.spec.ts
@@ -36,12 +36,14 @@ describe('config', () => {
       });
     });
     test('server settings', () => {
-      expect(config.serverSettings).toEqual({
-        baseUrl: 'http://localhost:8888',
-        token: 'test-secret',
-        appendToken: true,
-        wsUrl: 'ws://localhost:8888',
-      });
+      expect(config.serverSettings).toEqual(
+        expect.objectContaining({
+          baseUrl: 'http://localhost:8888',
+          token: expect.any(String),
+          appendToken: true,
+          wsUrl: 'ws://localhost:8888',
+        }),
+      );
     });
   });
 });
diff --git a/packages/core/tests/options.spec.ts b/packages/core/tests/options.spec.ts
index 9095c90e..0f9a9cee 100644
--- a/packages/core/tests/options.spec.ts
+++ b/packages/core/tests/options.spec.ts
@@ -87,12 +87,14 @@ describe('options', () => {
   });
   describe('server settings', () => {
     test('defaults', () => {
-      expect(makeServerSettings({})).toEqual({
-        baseUrl: 'http://localhost:8888',
-        token: 'test-secret',
-        appendToken: true,
-        wsUrl: 'ws://localhost:8888',
-      });
+      expect(makeServerSettings({})).toEqual(
+        expect.objectContaining({
+          baseUrl: 'http://localhost:8888',
+          token: expect.any(String),
+          appendToken: true,
+          wsUrl: 'ws://localhost:8888',
+        }),
+      );
     });
     test('overrides', () => {
       expect(