Random Bytes Generator

Generates up to 256 bytes of cryptographically secure random data from the browser's crypto.getRandomValues(), formatted for wherever it is going: lowercase or uppercase hex, standard or URL-safe Base64, a binary string, a decimal byte array, a C uint8_t literal, a Python b'...' literal, or an RFC 4122 version 4 UUID once you have asked for sixteen bytes or more. Separators — none, space, comma, colon or dash — let the output match a MAC address, a certificate fingerprint or whatever your config file expects.

The distinction that matters is the source. Math.random() is a fast pseudo-random generator built for shuffling and animation, and its output is predictable to anyone who observes enough of it — a session token drawn from it is not a secret. crypto.getRandomValues() draws from the operating system's cryptographic generator, which is seeded from hardware entropy and designed so that seeing past output tells you nothing about future output. Every secret belongs in the second category, and there is no performance reason to prefer the first.

How many bytes is a real question with a boring answer: 16 bytes is 128 bits, which is the conventional floor for anything a stranger might try to guess, and 32 bytes is what you want for a long-lived secret such as a signing key. Encoding changes the length but not the strength — 16 bytes is 32 hex characters or 24 Base64 characters, all carrying the same 128 bits — so a longer-looking string is not a stronger one. URL-safe Base64 is worth choosing over the standard alphabet for anything that will appear in a path or query string, since + and / need escaping there and = padding is often stripped in transit.

The UUID option has a detail people miss. A version 4 UUID is 128 bits wide but only 122 of them are random; four bits record the version and two record the variant. That is still far beyond collision range, but if you are budgeting entropy for a token, count 122 and not 128 — and if you need the full 128, take the raw bytes as hex instead.