openssl rand -hex 32
- Input
- 32 bytes em hex
- Expected output
- 64 caracteres, 256 bits
2 characters per byte.
Carregando ferramenta… / Loading tool…
generate random hex base64 string openssl rand
In the Hex, Base64, Base64URL and Base32 formats of the generator, the parameter is the number of random bytes. Below, the size table and the explanation of why drawing characters calls for rejection.
2 characters per byte.
Ends with one = because 32 is not a multiple of 3.
No padding.
The usual size of TOTP secrets.
32 x log2(62).
Use at least 32 random bytes (256 bits): RFC 7518, section 3.2, says the HMAC key must be the size of the hash output or larger, that is 256 bits for HS256, 384 for HS384 and 512 for HS512. A short phrase or dictionary word as the secret can be cracked by offline brute force from a single token.
Neither. Security comes from the number of random bytes, and both encodings write the same bytes. Base64 simply spends fewer characters for the same value.
A UUID v4 has 122 random bits in 36 characters and works as an identifier. As a signing key it falls below 128 bits, and the format reveals its structure. Prefer 32 bytes in hex or base64.
In .env files and environment variables it works unquoted. In URLs and headers, use base64url, which has no = and none of the + and / characters that need escaping.
Random bytes in hexadecimal: 2 characters per byte. 32 bytes give 64 characters and 256 bits.
openssl rand -hex 32python3 -c "import secrets; print(secrets.token_hex(32))"Pick the variables and copy the block. Each generation draws new values; values with $, # or spaces come out quoted.
Turn on at least one variable.
For production, prefer generating locally with the terminal command. Any secret typed or copied from a web page should be treated as exposed if you do not trust the device or the browser extensions. Nothing here is sent or stored.