Is this cryptographically secure?

Yes. It uses `crypto.getRandomValues()`, the Web Crypto API's CSPRNG. All generation happens locally in your browser — bytes never leave your device.

For most security uses (keys, tokens, salts) you need 16-64 bytes. Capping prevents accidentally locking the UI with multi-MB output. Use a CLI tool (`openssl rand`, `head /dev/urandom`) for large amounts.

What's the difference between Base64 and Base64URL?

Base64 uses `+`, `/`, and `=` padding — fine for JSON but unsafe for URLs and filenames. Base64URL replaces `+` → `-`, `/` → `_`, drops `=` padding — used in JWTs, OAuth state, and URLs.

Random Bytes Generator

Generate up to 256 bytes of cryptographically secure random data using the browser's `crypto.getRandomValues()` API — suitable for API keys, session tokens, IVs, salts, and test fixtures. Output formats cover most needs: lowercase/uppercase hex, standard or URL-safe Base64, binary string, decimal byte array, C uint8_t array literal, Python `b'...'` literal, and RFC 4122 v4 UUID (when 16+ bytes are generated). Separator options (none/space/comma/colon/dash) let you match MAC-address, certificate-fingerprint, or custom formats.

—

How to use

Pick byte count (1-256) — 16 for an IV, 32 for an HMAC key, 64 for an OAuth client secret.
Choose the output format. Use Base64URL for cookies and JWTs (no padding, URL-safe).
Click 'Generate' for a fresh value; changing options re-renders the existing bytes.

Frequently asked questions

Is this cryptographically secure?: Yes. It uses `crypto.getRandomValues()`, the Web Crypto API's CSPRNG. All generation happens locally in your browser — bytes never leave your device.
Why 256 bytes max?: For most security uses (keys, tokens, salts) you need 16-64 bytes. Capping prevents accidentally locking the UI with multi-MB output. Use a CLI tool (`openssl rand`, `head /dev/urandom`) for large amounts.
What's the difference between Base64 and Base64URL?: Base64 uses `+`, `/`, and `=` padding — fine for JSON but unsafe for URLs and filenames. Base64URL replaces `+` → `-`, `/` → `_`, drops `=` padding — used in JWTs, OAuth state, and URLs.

Guides on this topic

Passwords and Passphrases: What Actually Makes One Strong Why length beats symbol substitution, where password strength meters mislead, how passphrases work, and what two-factor authentication does and does not protect.

Related tools

UUID Generator

Generate random version-4 UUIDs in bulk, with copy.

Developer 0 0

Password Generator

Generate strong, random passwords that never leave your browser.

Random 0 0

Tailwind Color Palette

The full Tailwind CSS default palette — 22 hues × 11 shades, 50 through 950 — with click-to-copy as Tailwind class, HEX, or rgb().

Color 0 0

Unicode Character Inspector

Break a string into characters and show each codepoint, UTF-8 bytes, HTML entity, CSS escape, and Unicode block.

Text 0 0

Random Color Generator

Generate a grid of random colors in HEX, RGB or HSL — pick how many, copy any value with one click, and regenerate instantly for design inspiration.

Random 0 0

Base64 to Hex Converter (and back)

Convert a Base64 string to hexadecimal bytes and hex back to Base64, with URL-safe support, in your browser.

Developer 0 0