Random Base64 Secret Generator
Random secrets encoded as base64 or URL-safe base64url.
$ openssl rand -base64 32
Base64 vs base64url
Base64 packs 6 bits into each character, making it ~33% denser than hex: 32 random bytes fit in 43 characters instead of 64. Standard base64 uses + and / plus = padding — characters that break URLs, filenames and some config parsers. base64url (RFC 4648 §5) swaps them for - and _ and drops the padding, which is why it's the default here and the encoding JWTs themselves use.
Where you'd use one
Random base64 strings are the conventional format for many framework secrets: a NextAuth/Auth.js AUTH_SECRET, cookie-session keys, Laravel's APP_KEY (base64-prefixed), or any place documentation says openssl rand -base64 32. This page generates the same thing — 16 to 128 bytes from your browser's CSPRNG, encoded in the variant you pick.
Entropy comes from bytes, not characters
A secret's strength is the number of random bytes behind it, not its printed length. 32 bytes carry 256 bits of entropy whether shown as 64 hex characters or 43 base64 characters. Everything is generated locally with crypto.getRandomValues(); nothing is transmitted or stored.
base64 or base64url?
base64url unless something demands otherwise. Standard base64 uses + and / plus = padding — characters that break URLs, filenames and some config parsers. base64url (RFC 4648 §5) swaps them for - and _ and drops the padding. One important exception: framework secrets like Laravel's APP_KEY want standard base64, and base64url will silently decode to the wrong bytes.
Is this the same as openssl rand -base64 32?
Yes, if you pick standard base64 — same 32 random bytes, same encoding. Note that the 32 in that command is the number of bytes, not the length of the output: it prints 44 characters (43 plus one = of padding).
Why is 32 bytes only 43 characters?
base64 packs 6 bits into each character, so 32 bytes (256 bits) needs ⌈256/6⌉ = 43 characters — about 33% denser than hex's 64. Both carry exactly the same 256 bits of entropy. A secret's strength is the number of random bytes behind it, never its printed length.
Nothing leaves your browser
- Don't take our word for it — turn off your wifi. Every generator on this site keeps working with the network disconnected. That's the whole proof, and it takes five seconds.
- Every value comes from
crypto.getRandomValues()— the CSPRNG built into your browser, neverMath.random(). - Generated secrets are never transmitted, logged or stored: no server-side generation, no cookies, no localStorage.
- Verify it yourself in the network tab: after loading, the page only talks to our self-hosted, cookie-less analytics — which counts page views and which generator type gets copied, never any value.
- Strict Content-Security-Policy; no third-party script origins.
All generators
- UUID Generator
- Password Generator
- Hex Secret Generator
- JWT Secret Generator
- Passphrase Generator
- SSH Key Generator (Ed25519)
- PIN Generator
- WireGuard Key Generator
- API Key Generator
- TOTP Secret Generator
- Django SECRET_KEY Generator
- Laravel APP_KEY Generator
- NextAuth Secret Generator
- Flask SECRET_KEY Generator
- Rails secret_key_base Generator
- Strapi APP_KEYS Generator
- ULID Generator
- Nano ID Generator