Random Byte/Hex Generator Online | Secure CSPRNG (Hex, Base64, Binary)

Token Generation
100% client-side. Processed locally in your browser using the Web Crypto API. Nothing is sent to any server.

How It Works

This tool generates raw random material from the Web Crypto API's cryptographically secure random number generator (CSPRNG). Every value is drawn fresh from the operating system entropy pool — nothing is derived from a seed, and nothing leaves your browser. Specify 1 to 1024 bytes, choose up to four output formats simultaneously (Hex, Base64, URL-safe Base64, and binary), and generate up to 100 values in a single batch. The tool works fully offline once the page is cached.

Byte Length Recommendations

BytesBitsHex LengthBest for
129624 charsAES-GCM nonces (IVs)
1612832 charsSession tokens, minimum security
3225664 charsAPI keys, AES-256 keys, shared secrets
64512128 charsLong-lived master secrets

Code Examples

Generate random bytes with Web Crypto API:

// Browser — Generate 32 random bytes
const bytes = new Uint8Array(32);
crypto.getRandomValues(bytes);

// Convert to hex
const hex = Array.from(bytes)
  .map(b => b.toString(16).padStart(2, '0'))
  .join('');
console.log(hex);  // 64 hex characters

// Convert to Base64
const base64 = btoa(String.fromCharCode(...bytes));
console.log(base64);  // 44 characters

// URL-safe Base64
const urlSafe = base64.replace(/+/g, '-').replace(///g, '_').replace(/=+$/, '');
console.log(urlSafe);
# Python — Generate random bytes
import secrets
import base64

# 32 random bytes
random_bytes = secrets.token_bytes(32)

# Hex output
print(random_bytes.hex())

# Base64 output
print(base64.b64encode(random_bytes).decode())

# URL-safe Base64
print(base64.urlsafe_b64encode(random_bytes).decode().rstrip('='))

Security Notes

  • Use CSPRNG for security — this tool uses crypto.getRandomValues() (CSPRNG); never use Math.random() for cryptographic purposes.
  • Entropy equals byte length × 8 — 32 bytes provides 256 bits of entropy, matching AES-256 security level.
  • Base64URL for web tokens — use URL-safe Base64 for API keys and tokens to avoid encoding issues in URLs.
  • Fresh on each click — every generation draws new random bytes; previous values cannot be predicted.

Related Tools

Need human-readable secrets? Try the Passphrase Generator. For password creation, see the Password Generator. To validate BIP39 mnemonics generated from random entropy, use the BIP39 Mnemonic Validator.

Frequently Asked Questions

Are these random bytes cryptographically secure?

Yes. The tool uses crypto.getRandomValues(), the browser built-in CSPRNG, which is seeded from the operating system entropy pool. This is the same source of randomness used for TLS session keys — not to be confused with Math.random(), which is predictable and must never be used for security purposes.

What is the difference between hex, Base64, and binary output?

They are different encodings of the exact same random bytes. Hex uses two characters per byte (easy to read and paste into code), Base64 packs three bytes into four characters (about 25% more compact), and binary shows the raw bits. A 32-byte value is 64 hex characters, roughly 43 Base64 characters, or 256 binary digits.

How many bytes should I generate?

It depends on the use case: 16 bytes (128 bits) is the practical minimum for session tokens; 32 bytes (256 bits) matches AES-256 keys and is the recommended size for API keys and shared secrets; 64 bytes (512 bits) suits long-lived master secrets. Entropy always equals 8 × byte length.

Can I use this tool to generate API keys or secret tokens?

Yes. Generating 32 bytes in Base64URL gives you a URL-safe, high-entropy token in the same style as secrets issued by GitHub, Stripe, or AWS. For secrets that must be typed or memorized by humans, consider the Passphrase Generator instead.

Is anything logged or sent to a server?

No. Generation runs entirely in your browser using the Web Crypto API — no values, lengths, or usage patterns are stored or transmitted. Once the page is cached, the tool even works fully offline.

Privacy: This tool runs entirely in your browser — nothing is uploaded or stored. · Disclaimer: For educational purposes only. Not professional security advice.

More in Tokens