Random Bytes

What is cryptographic randomness?

Random bytes are used for cryptographic keys, initialization vectors, salts, nonces, session tokens, and anywhere that predictability would be a security flaw. The bytes must come from a cryptographic random source, not a generator optimized for games or statistics.

This tool uses the browser cryptographic random source, which draws from the operating system entropy pool. The same source is used by TLS, SSH, and every modern browser cryptographic engine. Output is not seeded by the page, timestamp, or user actions.

How to use

Choose how many bytes to generate and the output format. Hex is the safest format for copy-pasting into config files and scripts. Base64 is more compact. URL-safe Base64 replaces the plus and slash characters with dash and underscore. Decimal shows each byte as a space-separated integer from 0 to 255.

Which size to choose

16 bytes (128 bits) for salts, nonces, and CSRF tokens. 32 bytes (256 bits) for symmetric encryption keys, matching the AES-256 standard. 48 bytes for 384-bit keys. 64 bytes for maximum security margins or as a master seed that will be hashed again.

FAQ

Is the output cryptographically random?

Yes. It comes from the operating system cryptographic random number generator. The values are uniformly distributed and unpredictable, even if an attacker knows everything about the page and the browser.

Are the bytes sent anywhere?

No. Generation is entirely local. The page does not make network requests when you click Generate.

Can I reproduce the same bytes later?

No, and that is the point. Every click produces fresh values. If you need a deterministic sequence, use a hash or a key derivation function with a known seed.

Should I use these bytes as a password?

They are cryptographically strong but not human-friendly. For a human-typed password, use the Password Generator. For a key or token, use these bytes directly.