Random Base64 Generator

Bytes, characters and entropy

The strength of a random string is measured in bits of entropy. Every random byte adds 8 bits, so 16 bytes give 128 bits and 32 bytes give 256 bits. Base64 only changes how those bytes are written: each character carries 6 bits, and every 3 bytes become 4 characters. The tool shows the entropy of each string, so you can check it at a glance.

With the bytes unit, the output decodes to exactly that many random bytes, which is what keys and secrets need. With the characters unit, you get an exact number of characters, each picked uniformly from the 64-character alphabet; use it when a system asks for a token of a fixed length and stores it as text.

Where random Base64 values are used

• JWT secrets. RFC 7518 requires an HMAC key at least as long as the hash output: 32 bytes for HS256, 48 for HS384 and 64 for HS512. Some libraries use the secret string as is, others Base64-decode it first, so check which one yours expects. The JWT decoder verifies HS256 to HS512 signatures with either kind of secret, and the HMAC generator accepts a key as text, hex or Base64.
• Application keys. Laravel, for example, keeps a 32-byte encryption key in its .env file as APP_KEY=base64:..., the same form as a 32-byte string from this tool.
• Kubernetes Secrets. Values under data must be standard Base64 with padding. A string generated in bytes mode with the Standard variant and padding on can go there directly, and the Pod receives the raw random bytes. If the application expects the Base64 text itself, put it under stringData instead.
• Tokens in URLs. Password reset links, invitation codes and other tokens that travel in URLs should use the URL-safe variant, which replaces + and / with - and _. See Base64URL for details.

Why crypto.getRandomValues and not Math.random

Math.random() is a fast general-purpose generator. Its output is not designed to be unpredictable, and with some engines the internal state can be reconstructed from a handful of values. This tool uses crypto.getRandomValues(), a cryptographically secure generator seeded by the operating system, the same kind of source behind openssl rand and Python's secrets module. The values are created on your device and are never sent or stored.

Generate random Base64 in code

# Shell: 32 random bytes as Base64 (44 characters)
openssl rand -base64 32
head -c 32 /dev/urandom | base64

# Python
import base64, secrets
base64.b64encode(secrets.token_bytes(32)).decode()
secrets.token_urlsafe(32)        # URL-safe, no padding, 43 characters

// Node.js
const crypto = require('crypto');
crypto.randomBytes(32).toString('base64');
crypto.randomBytes(32).toString('base64url');   // URL-safe, no padding

// Browser
const bytes = crypto.getRandomValues(new Uint8Array(32));
btoa(String.fromCharCode(...bytes));