Generators

Secure Random Data Generator

Generate Base64URL, hex, alphanumeric, or numeric random values.

Cryptographically secure random data
crypto.getRandomValues()
Generated values

Secure Random Data

Generate Base64URL, hex, alphanumeric, or numeric values with crypto.getRandomValues(). Configure length, count, and an optional fixed prefix.

Usage

  • Base64URL works well in URLs, cookies, and API tokens
  • Hex is useful for keys, salts, and debug output
  • A fixed prefix is not random and should not be counted as entropy

Frequently Asked Questions

Are the generated values cryptographically secure?
Yes. Everything comes from the Web Crypto API’s crypto.getRandomValues(), backed by the operating system’s CSPRNG — safe for keys, tokens, and salts. Never use Math.random() for these: it is predictable pseudo-randomness.
How long should an API token be?
Rule of thumb: at least 128 bits of entropy (about 22 Base64URL characters or 32 hex); security-critical credentials 256 bits (64 hex). Length sets the enumeration cost, which pairs with server-side rate limits and expiry for a complete design.
Does a fixed prefix hurt randomness?
The prefix contributes no entropy, but it helps humans identify purpose (sk_live_, pat_). Count only the random part when quoting strength — including the prefix overstates security. Also watch total length against field limits downstream.