How to generate random Base64
- Set Bytes to the amount of randomness you need, from 1 to 4096. The default of 32 bytes is 256 bits.
- Choose the Format: Base64, Base64URL (URL-safe, no padding) or hex. For Base64 you can also tick No padding (=).
- Set How many to generate several values at once, up to 1000, one per line.
- Copy the output, download it as a text file, or press Generate new for a fresh set. Entropy and Length under the output show the bits of randomness and the character count.
If you need a key in a particular format, such as a Laravel APP_KEY or an AES-256 key, use one of the Presets at the top; the Base64 key generator explains each of them.
How long the output will be
The randomness is in the bytes; the format only decides how they are written. Base64 packs 6 bits into each character, hex only 4, so hex is always longer for the same strength:
| Bytes | Bits | Base64 | Base64, no padding | Base64URL | Hex |
|---|---|---|---|---|---|
| 8 | 64 | 12 | 11 | 11 | 16 |
| 16 | 128 | 24 | 22 | 22 | 32 |
| 24 | 192 | 32 | 32 | 32 | 48 |
| 32 | 256 | 44 | 43 | 43 | 64 |
| 48 | 384 | 64 | 64 | 64 | 96 |
| 64 | 512 | 88 | 86 | 86 | 128 |
Byte counts divisible by 3 (24, 48) produce no = at all, so the padded and unpadded columns match. Use Base64URL when the value goes into a URL, a filename or a cookie, because + and / would need escaping there.
How many bytes to use
- Unique IDs, request IDs, upload names: 16 bytes (128 bits). Guessing or colliding with one is not a practical concern.
- Session tokens, API tokens, password-reset links: 32 bytes. The extra margin costs about 20 characters.
- Salts for password hashing: 16 bytes is the usual recommendation; the salt does not need to be secret, only unique.
- Test fixtures: any size, and How many fills a file with a thousand values in one go.
A random string is only as strong as its byte count. Cutting a 44-character value down to 20 characters to fit a field throws away more than half of its entropy, so pick a smaller byte count instead and keep the full output.
The same in a terminal or in code
These all produce 32 random bytes as Base64 (secrets.token_urlsafe in the URL-safe alphabet, without padding):
openssl rand -base64 32
head -c 32 /dev/urandom | base64
import base64, secrets
print(base64.b64encode(secrets.token_bytes(32)).decode())
print(secrets.token_urlsafe(32))
In Node.js, crypto.randomBytes(32).toString("base64url") gives the URL-safe form. One trap with OpenSSL: above 48 bytes, openssl rand -base64 wraps its output at 64 characters, so a 64-byte value arrives as two lines. Use openssl rand 64 | openssl base64 -A for a single line, or strip the newline before putting it in a config file. More recipes are on the OpenSSL and Python pages.
FAQ
Is this random generator secure enough for passwords and tokens?
Yes. It uses crypto.getRandomValues, the browser’s cryptographically secure random number generator. Avoid Math.random() for anything secret; it is not designed to be unpredictable.
How do I get a random Base64 string of exactly N characters?
Choose N × 3 ÷ 4 bytes. With a byte count divisible by 3 there is no padding, so 33 bytes give exactly 44 characters and 48 bytes give 64. Otherwise tick No padding (=) and the length is ⌈4 × bytes ÷ 3⌉.
Can two generated values ever be the same?
In theory, but with 16 bytes (128 bits) or more the chance is negligible: you would need around 2^64 values before a collision becomes likely. That is why 16 bytes is a common minimum for unique random IDs.
Are the values saved anywhere?
No. They are held in this tab’s memory until you copy or download them, and the page cannot make network requests other than Cloudflare’s page-view count. Reload the page and they are gone.