Skip to content
100% local

Random bytes generator

Generate cryptographically secure random bytes as hex, Base64 or a byte array.

Output

Random bytes generator

Generate cryptographically secure random bytes and see them encoded the way you need them. It is the browser equivalent of running openssl rand -hex 32 or openssl rand -base64 32: pick how many bytes you want, choose a format, and the value appears immediately. Typical uses are API keys, session secrets, encryption keys, salts, nonces, CSRF tokens and test fixtures.

Choose between lowercase or uppercase hex, standard Base64, URL-safe Base64url without padding, a decimal byte array such as [12, 255, 7] or a 0x-prefixed hex array that you can paste straight into C, Go, Rust or Java source. The length counts bytes, not characters, so hex output is always exactly twice the number of bytes and 32 bytes give you 256 bits of entropy. Set how many values to create at once, add a prefix such as sk_ to every line, or split hex into hyphen-separated groups to make long keys easier to read and compare.

The bytes come from the Web Crypto API through crypto.getRandomValues, the same operating-system source that browsers use for TLS, and never from Math.random. A single value can be up to 1024 bytes and a run can create up to 1000 of them. The tally under the result shows the byte count, the bits of entropy, the output length and the equivalent openssl command for your chosen length and format.

Everything runs locally in your browser. The bytes are generated on your device, never uploaded and never stored, so the secrets you create stay yours. Copy the result, download it as a .txt file or send it to another tool.

FAQ

How is this different from the random string generator?
The random string tool draws characters from a character set and counts characters. This tool counts bytes and then encodes them, so hex length is always two times the bytes, matching openssl rand.
How many bytes do I need for a secret key?
For most API keys and session secrets 32 bytes (256 bits) is plenty. Use 16 bytes (128 bits) as a minimum for tokens and 64 bytes for keys that must outlast long-term attacks.
Which format should I choose?
Hex is the safest for config files and shells. Base64 is shorter, and Base64url is the one to use inside URLs, JWT secrets and filenames because it avoids plus, slash and padding characters.
Are the bytes truly random and are they uploaded anywhere?
They come from crypto.getRandomValues, the secure random generator built into your browser, and are created on your device. Nothing is sent to a server or saved, so your secrets stay local.