APNS device tokens are 32 bytes in binary format. If you choose to represent them as 64 hexadecimal characters, then they would contain just the hexadecimal characters (0 to 9 and A to F).
As for GCM Registration IDs, even though Google don't give any rules regarding possible characters, from what I observed, they use only 64 characters - A to Z, a to Z, 0 to 9, '-' and '_'.