# Random Bytes Generator Generate cryptographically secure random bytes and output them as hex, Base64, Base64URL, binary, decimal, a C array or a Python bytes literal. ## Run it - **CLI:** `gizza tool random-bytes 'bytes=32'` - **Web:** https://gizza.ai/tools/random-bytes/ - **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/random-bytes/tool.json ## Inputs - `bytes` — Bytes per value _(field)_ - `count` — How many values _(field)_ - `encoding` — Output encoding _(field)_ - `separator` — Byte separator (hex, binary, decimal only) _(field)_ - `uppercase` — Uppercase hex digits _(field)_ - `output` — Result format _(field)_ - `seed_hex` — Seed (optional — makes the output reproducible) _(field)_ ## Output - Random bytes (text) ## Query parameters Open the tool pre-filled and auto-run via URL: - `bytes` — Bytes per value - `count` — How many values - `encoding` — Output encoding - `separator` — Byte separator (hex, binary, decimal only) - `uppercase` — Uppercase hex digits - `output` — Result format - `seed_hex` — Seed (optional — makes the output reproducible) Example: `https://gizza.ai/tools/random-bytes/?bytes=32&count=1&encoding=hex&separator=auto&uppercase=true&output=text&seed_hex=00112233445566778899aabbccddeeff` --- ## About this tool Use this random bytes generator when you need a specific number of cryptographically secure **bytes** — an AES key, an HMAC or JWT signing secret, an IV or nonce, a password salt, a session token, or a test fixture — and you want those exact bytes formatted for wherever they are going. Pick the byte count, then choose an encoding: hex, padded Base64, URL-safe Base64 without padding, binary, decimal, a C initializer list, or a Python bytes literal. The bytes are drawn in your browser from the platform cryptographic random source; nothing is uploaded, and the optional `seed_hex` field makes a run reproducible for tests and documented fixtures. The byte count is what sets the strength. 32 bytes is 256 bits of entropy whether you print it as 64 hex characters or 44 Base64 characters — the encoding changes the length of the string, never the amount of randomness behind it. That is the difference between this tool and a character-count generator: asking for "32 hex characters" gives you only 16 bytes, or 128 bits. Set `count` to draw up to 100 independent values in one run, for example to seed a key-rotation table or to fill a staging environment's secrets. ### Worked example For a deterministic example, set `bytes = 8`, `count = 3`, `encoding = hex`, `separator = auto`, and `seed_hex = 00112233445566778899aabbccddeeff`. The result is three 16-character hex values, one per line, followed by the summary line `3 values · 8 bytes (64 bits) each · hex · equivalent: openssl rand -hex 8`. Switch `encoding` to `base64` and the same three draws come back as 12-character padded Base64 strings instead. For real secrets, leave `seed_hex` blank so every run draws fresh bytes from the cryptographic RNG. ### Limits and edge cases - `bytes` accepts 1 to 4096 bytes per value, which covers everything from a 1-byte test vector to a 4096-bit RSA modulus. - `count` accepts 1 to 100 values, and `bytes × count` may not exceed 8192 random bytes per run, so a large-times-large request is rejected with an explicit message instead of producing a multi-megabyte string. - `separator` only applies to the one-unit-per-byte encodings (hex, binary, decimal). Base64, Base64URL, the C array, and the Python literal have no per-byte boundary to split, so they ignore it rather than corrupting the encoding. - `uppercase` affects the hex digits of the `hex` and `c-array` encodings only. - `base64` uses the RFC 4648 standard alphabet with `=` padding, matching `openssl rand -base64`. `base64url` uses the URL-safe alphabet with padding stripped, which is the form JWT segments and URL-embedded tokens expect. - `seed_hex` must be 8 to 128 hex digits. Whitespace inside a pasted seed is ignored. A seeded run is reproducible, not secret: anyone holding the seed can regenerate the identical bytes. ## FAQ
How many bytes should I generate for a key or secret? For symmetric keys, match the algorithm: 16 bytes for AES-128, 32 bytes for AES-256 or ChaCha20-Poly1305, and 32 bytes for an HMAC-SHA256 or JWT signing secret. Nonces and IVs are algorithm-specific — 12 bytes for AES-GCM and ChaCha20-Poly1305, 16 bytes for AES-CBC. Password salts are commonly 16 bytes. When nothing dictates a size, 32 bytes (256 bits) is a safe default and is what this page starts with.
Is this the same as `openssl rand`? It produces the same kind of output from an equally strong random source, and the summary line prints the matching command (`openssl rand -hex 32`, `openssl rand -base64 32`) so you can compare or script it later. The difference is where the randomness comes from: this page calls the browser's Web Crypto random source, and the command-line version of the tool calls the operating system's. Both are cryptographically secure generators, not the ordinary pseudo-random function a language's `random()` uses.
What is the difference between Base64 and Base64URL here? Both encode the identical bytes. `base64` uses the RFC 4648 standard alphabet, which includes `+` and `/`, and pads the result with `=` so its length is a multiple of four. `base64url` swaps those two characters for `-` and `_` and drops the padding, so the value is safe to place in a URL path, a query string, a filename, or a JWT segment without further escaping. Choose `base64url` for tokens and `base64` when a config file or library expects the classic padded form.
How is this different from a random token or password generator? This tool is driven by a byte count: you ask for 32 bytes and get exactly 256 bits, rendered in the encoding you pick. A token generator is driven by a character count over an alphabet, so 32 characters of hex is only 128 bits — useful when a field has a fixed width, but a different question. A password generator additionally optimises for something a person can type and read, at the cost of entropy per character. Use this page for machine-consumed key material.
Why would I set a seed? Set `seed_hex` only when you need identical bytes on every run: a unit test with a fixed expectation, a documentation example, or a shareable link that reproduces the same output for a colleague. The values are then derived deterministically from the seed, so they are exactly as secret as the seed itself. Leave the field blank for anything that will protect real data.
Can I get the raw binary bytes as a file? Not directly — every encoding on this page is a text rendering of the bytes, and the result is copyable and downloadable as text. To turn it back into raw bytes, generate `hex` output and decode it where you need it, for example `xxd -r -p` on the command line or `bytes.fromhex()` in Python. The `c-array` and `python-bytes` encodings exist so you can paste the bytes straight into source code without a decoding step.
## Related tools - [Absolute value, sign, or negation for a whole column](https://gizza.ai/tools/absolute-value-transformer/): Paste a column of numbers and apply absolute value, sign extraction (-1/0/1), sign flipping, or force-negative to every value at once, with rounding and an audit table. - [Adjacency Matrix Converter](https://gizza.ai/tools/adjacency-matrix-converter/): Convert a graph between edge list, adjacency matrix, and incidence matrix — directed or undirected, weighted or not. Free, private, runs in your browser. - [Amazon Order Analyzer](https://gizza.ai/tools/amazon-order-analyzer/): Paste an Amazon order-history CSV export to summarize total spend by month, top items, and category breakdowns. Browser-only, private, with Markdown or JSON output. - [ARFF Converter](https://gizza.ai/tools/arff-converter/): Convert Weka ARFF datasets to CSV and CSV tables back to ARFF locally — nominal attributes, numeric types, dates, sparse rows, missing values, and type rows. - [Avro to JSON Converter](https://gizza.ai/tools/avro-to-json/): Decode Apache Avro Object Container Files (.avro / OCF) to JSON, NDJSON, or the embedded schema — no .avsc needed, free and private in your browser.