Is this random generator cryptographically secure?

Yes. It calls crypto.getRandomValues from the Web Crypto API, which browsers back with a cryptographically strong pseudo-random number generator seeded from the operating system entropy pool. It is not Math.random, which is unsuitable for secrets.

How many bytes should I generate for a token?

32 bytes (256 bits) is a common, comfortable default for session IDs, CSRF tokens, and API keys. 16 bytes (128 bits) is the practical minimum for security; use more if you need extra margin.

What is the difference between base64 and base64url?

Standard base64 uses + and / and pads with =, which must be encoded in URLs. Base64url replaces + with - and / with _ and drops the padding, so the value can be dropped straight into a URL or filename.

Are the generated bytes ever sent to a server?

No. Generation and encoding happen entirely in your browser with no network calls. You can disconnect from the internet and the tool still works, so the secrets never leave your device.

Why does the decimal output get so long?

The bytes are interpreted as one big-endian integer, so 32 bytes is a 256-bit number with up to 78 decimal digits. It is computed with BigInt for exact, arbitrary-precision conversion.

What is the Secure Random Bytes / Hex Generator?

Generates 8 to 512 cryptographically secure random bytes with the browser's Web Crypto API (crypto.getRandomValues) and encodes them as hex, uppercase hex, base64, base64url, or a big-decimal integer. Ideal for CSRF tokens, session IDs, encryption keys, and test fixtures. It runs free in your browser on Gera Tools, with nothing uploaded.

Secure Random Bytes / Hex Generator

Name: Secure Random Bytes / Hex Generator
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

Generate cryptographically secure random values in your browser

Whether you need a session secret, a CSRF token, an encryption key, or a reproducible-looking test fixture, you want randomness from a cryptographically strong source — not Math.random. This generator uses the Web Crypto API directly, produces between 8 and 512 bytes, and encodes them in whichever format your code expects.

How it works

The tool allocates a Uint8Array of the requested length and fills it with crypto.getRandomValues(), the browser’s CSPRNG. The raw bytes are then encoded:

Hex / HEX — each byte becomes two hex characters (toString(16) padded to 2), lower or upper case.
Base64 / Base64URL — the bytes are turned into a binary string and passed to btoa; the URL-safe variant swaps +// for -/_ and strips = padding.
Decimal — the bytes are read big-endian into a BigInt so even 512-byte values convert exactly with no floating-point loss.

The byte count is clamped to the 8–512 range, and the tool falls back to a clear message if Web Crypto is unavailable.

Choosing the right size and format

Use case	Recommended bytes	Format
Session ID / cookie	32	hex or base64url
CSRF token	32	hex or base64url
AES-256 key	32	hex or base64
AES-128 key	16	hex or base64
API key (URL-safe)	32	base64url
Nonce / IV	16	hex
HMAC secret	64	hex

For example: a 32-byte base64url token is 43 characters long with no padding, no +, and no / — drop it directly into a URL query parameter or Authorization: Bearer header without any additional encoding step. A 32-byte hex string is 64 lowercase characters, which is easy to copy and store in most databases.

Why `Math.random` is not safe

Math.random is a pseudo-random number generator seeded at startup; its output can be predicted if an attacker observes enough values. For tokens and secrets this is unacceptable. crypto.getRandomValues draws from the operating system’s entropy pool — physical hardware events, timing jitter, interrupt noise — which an attacker cannot predict or reproduce.

Security hygiene after generating

Store in a secrets manager or environment variable, never in source code.
Set an expiry on session tokens; rotate API keys on a regular schedule.
Log a token ID or a hash (never the raw value) for audit trails.
If a secret is compromised, invalidate it immediately — the generator makes a new one in one click.
For encryption keys, the format matters: many libraries expect the raw bytes as a Buffer or Uint8Array, not a hex string, so check your library’s key-import API before choosing a format.

Everything runs in your browser — the bytes are generated locally and never sent anywhere.