Random keys in hex, base64 or UUID, entropy stated in bits.
What it's for
Make a long random key — the secret an app uses to sign logins, protect data or talk to another service — when setup instructions tell you to generate one.
Before you start
Know which format the instructions ask for, if they say. Have the settings file or form open, because the key is never saved: close the page and it is gone.
Start from the ready-made key
A new random key is at the top as soon as the page opens. It is made in your browser and is never sent anywhere.
Pick the format
Under Format, choose what the instructions ask for. Hexadecimal, which uses only 0–9 and a–f, is the safe choice for a settings file; Base64 (URL-safe) suits a web address, a file name or an environment variable. UUID v4 is an ID, not a strong secret.
Set the size and how many
Leave Random bytes at 32 unless you are told otherwise; with Alphanumeric the box is called Characters. Set How many if you need several keys — each comes on its own line.
Generate again and copy
Press Generate again for a fresh key, then Copy to take it. Changing any setting also makes a new key.
Reading the result
If it goes wrong
Strength is measured in bits, and the character count does not tell you how many there are. That is the one thing this page exists to make plain.
Ask for "32 characters" and what you get depends entirely on the format. In hexadecimal it is 128 bits, because two characters carry one byte. In base64 it is 192, because four characters carry three bytes. From a 56-character alphabet it is about 185. Same length, and the weakest is barely more than half the strongest. So the bit count is the figure printed large, and the length is a detail underneath it.
A UUID v4 is 122 bits, not 128. Four bits are pinned to the version and two to the variant, which is exactly what makes a UUID recognisable as a UUID. That is a fine trade for an identifier and a poor one for a signing key, and a good deal of software treats the two as interchangeable.
Everything here comes from crypto.getRandomValues, your operating system's cryptographic random source. Nothing uses Math.random, whose internal state can be recovered from a handful of outputs — perfectly good for shuffling a playlist, disqualifying for a key.
Ask in bits rather than characters. 128 bits is the usual floor for anything long-lived and 256 bits is the common choice for a signing key — that is 32 or 64 hexadecimal characters, or 22 and 43 in base64. The character count on its own tells you nothing, which is why the bit count is the large figure on this page.
Because a character carries a different amount of information in each format. Hexadecimal spends two characters on every byte, so it is 4 bits a character. Base64 packs 6 bits into each. An alphanumeric alphabet of 56 characters carries about 5.81. So 32 hexadecimal characters is 128 bits and 32 base64 characters is 192 — the same length and half as much strength again.
Usually not. A UUID v4 is 128 bits long but carries only 122 random ones — four bits are fixed to the version and two to the variant — and a great deal of software treats it as though it were a full 128. It is an excellent identifier: unique, sortable enough, recognisable. For something that signs tokens or protects data for years, generate 32 random bytes instead.
Hexadecimal if it will be read by a person or pasted into a config file — it uses only sixteen characters and survives being retyped. URL-safe base64 if it goes into a URL, a filename or an environment variable, because standard base64 contains plus, slash and padding, all of which bite in those places. A UUID when you want an identifier rather than a secret.
It uses your browser’s cryptographic random source, the same one used for TLS keys, through crypto.getRandomValues. It never uses Math.random, which is a fast non-cryptographic generator whose internal state can be recovered from a handful of outputs — fine for shuffling a list and disqualifying for a key.
No. It is generated in your browser and never transmitted. Nothing is written to our servers and nothing is kept when you close the page, so save it somewhere before you navigate away — we cannot recover it for you.
Multiply by the length to get the strength. It is the only sum on this page that matters.
The same instruction, followed three ways, giving a fifty per cent spread in strength. "How many characters" is the wrong question.
Important
Generated in your browser and never transmitted or stored. Nothing here can be recovered once the page is closed, and a key is only as safe as where you put it next. Nothing you type here is sent to our servers — the calculation runs entirely in your browser.
