About the Random Hex Generator
Many secrets are specified as a number of random bytes shown in hex: a 32-byte encryption key, a 16-byte salt, a session token, a signing secret. This tool generates exactly that, drawing bytes from the browser's cryptographically secure random source and printing them as two hex characters each. Set the number of bytes to match the requirement, for example 32 bytes for a 256-bit key.
Bytes and characters are the easiest thing to confuse here. Each byte prints as two hex characters, so 16 bytes is a 32-character string and 32 bytes is 64 characters. When a library asks for a 128-bit key it wants 16 bytes, not 16 characters, and typing the wrong one quietly halves the strength of the key without any error. Hex is the usual transport form because it survives copy and paste, environment files, YAML and JSON with no escaping at all, unlike Base64 with its slashes and padding.
A typical use is filling in a SECRET_KEY, session secret or JWT signing key in a local .env file so a development server will start. Because it runs in your browser, the secret is never transmitted, though for production you should generate secrets in your deployment environment. For a random UUID use the UUID Generator; for a Base64 secret, the Random String Generator with the Base64 charset; to sign a payload once you have the key, the HMAC Generator.
How to use
- Set the number of bytes (32 for a 256-bit key).
- Choose how many to generate.
- Copy the hex string into your configuration.
Common questions
- How many bytes for a 256-bit key?
- 32 bytes, which is 64 hex characters.
- Is it secure enough for a real key?
- The randomness is cryptographically secure. For production, generate secrets in your server environment rather than a browser tab.
- Can I get uppercase hex?
- The output is lowercase; convert it with the Case Converter if you need uppercase.