# Secure Random Generator Generate cryptographically secure random key material driven by entropy budget — request N bits of entropy, get hex/base64/base64url output. Also supports custom-alphabet strings via crypto.randomInt (rejection-sampled, no modulo bias). Use this instead of Math.random()-based tools for any secret/key/token. > Canonical page: https://elysiatools.com/en/tools/secure-random-generator - **Category:** Security - **Keywords:** random, secure random, csprng, key generation, secret, entropy, hex, base64, base64url, crypto.randomBytes, security ## Overview This tool generates **cryptographically secure key material**. Unlike the existing random-string and password generators (which use `Math.random()` and are unfit for secrets), this tool is entropy-driven and CSPRNG-backed. **Entropy-driven input.** You specify a target entropy in *bits* (default 256, step 8) — the security strength you want — and the tool derives the byte count (`bytes = ceil(bits/8)`) for you. This is the right mental model for keys: a JWT HS256 secret needs 256 bits of entropy regardless of how many characters represent it. Don't think "how many characters", think "how much security". **Two output branches:** 1. **Byte encoding** (default — leave Custom Alphabet empty). Generates `ceil(entropyBits/8)` random bytes with `crypto.randomBytes()` and renders the same material in **three encodings side by side** — hex, base64, base64url — so you can copy whichever your consumer expects. Each byte contributes exactly 8 bits of entropy, so delivered entropy always equals what you requested. 2. **Custom alphabet** (fill Custom Alphabet). Samples `crypto.randomInt(alphabetSize)` per character — internally rejection-sampled by Node, so **no modulo bias** and no hand-written rejection loop needed. The actual entropy is `length × log₂(alphabetSize)`, which may be *less* than requested (e.g. 32-symbol alphabet × 10 chars = 50 bits, not 256); the tool warns you in red when this happens, because a short custom-alphabet string can be far weaker than it looks. **Why three encodings side by side?** A 256-bit key is 64 hex chars, ~44 base64 chars, or 43 base64url chars. Different systems expect different formats; showing all three lets you pick correctly without re-running. Use cases: AES-256 keys, HMAC keys, JWT signing secrets, API keys, session secrets, any value an attacker must not be able to guess. `crypto.randomBytes()` and `crypto.randomInt()` draw from the OS CSPRNG — never `Math.random()`. ## Inputs - **Entropy (bits)** (number): e.g. 256 - **Output Encoding** (select) - **Custom Alphabet (optional)** (text): e.g. abcdefghijklmnopqrstuvwxyz (leave empty for byte encoding) - **Custom String Length** (number): e.g. 32 - **Count** (number): e.g. 1 ## When to use - When generating cryptographic keys such as AES-256 keys, HMAC keys, or JWT signing secrets that require high entropy. - When creating secure API keys, session tokens, or passwords using a custom alphabet without introducing modulo bias. - When you need to verify the actual entropy strength of a custom-length string to ensure it meets security compliance standards. ## How it works - Specify your target security strength in bits of entropy, which the tool uses to calculate the required byte count. - Choose between standard byte encoding or input a custom alphabet to sample characters using rejection-sampled random integers. - The tool calls cryptographically secure system APIs to generate the random data, avoiding predictable pseudo-random algorithms. - View and copy the generated material in hex, base64, or base64url formats side-by-side, along with an entropy validation warning if a custom alphabet is used. ## Use cases - Generating 256-bit symmetric keys for AES-256 encryption or HMAC-SHA256 authentication. - Creating secure, non-predictable API tokens using a specific set of alphanumeric characters. - Generating session secrets and cookie signing keys for web application frameworks. ## Frequently asked questions ### Why should I use this instead of standard random string generators? Standard generators often use Math.random(), which is predictable. This tool uses cryptographically secure APIs (CSPRNG) suitable for secrets. ### What is modulo bias and how does this tool avoid it? Modulo bias makes certain characters more likely to appear. This tool uses rejection sampling via crypto.randomInt to ensure uniform distribution. ### How is the entropy calculated for custom alphabets? Entropy is calculated as length multiplied by the binary logarithm of the alphabet size, which may be lower than the requested entropy. ### Why does the tool display hex, base64, and base64url side-by-side? It allows you to instantly copy the exact format required by your application or configuration file without regenerating the key. ### What is the maximum entropy I can request? You can request up to 512 bits of entropy per generated key. ## Related tools - [Ed25519 / X25519 Keygen and Signature Verifier](https://elysiatools.com/en/tools/ed25519-x25519-keygen-signature-verifier): Generate Ed25519 or X25519 keypairs from random or deterministic seed text, then sign or verify messages - [Text Hash Generator](https://elysiatools.com/en/tools/text-hash-generator): Compute MD5, SHA-1, SHA-256, SHA-512, and CRC-32 hashes of any text in one shot. Get both hex and Base64 digests over the UTF-8 encoding. - [Digital Signature Generator](https://elysiatools.com/en/tools/digital-signature-generator): Sign a message with a private key or verify a signature with a public key — supports RSA-PSS (SHA-256), ECDSA (P-256), and Ed25519. Pure client-side crypto (Node crypto.createSign/createVerify), no network. Paste a PEM key to sign or to verify a base64 signature. This tool signs/verifies; it does not generate key pairs. - [PKCE Code Verifier & Challenge Generator](https://elysiatools.com/en/tools/pkce-code-verifier-generator): Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset \[A-Za-z0-9-._~\] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification. - [RSA Encrypt / Decrypt](https://elysiatools.com/en/tools/rsa-encrypt-decrypt): Encrypt text with an RSA public key or decrypt ciphertext with the matching private key, using OAEP padding (SHA-1 or SHA-256). Handles long messages by chunking. Keys and data stay local. PKCS#1 v1.5 is intentionally not offered (Node disables it for decryption due to Bleichenbacher attacks). - [CRC32 Checksum](https://elysiatools.com/en/tools/crc32-checksum): Compute the CRC32 checksum (IEEE 802.3 polynomial) of any text or raw bytes. Output as hex, decimal or binary. Accepts plain text (UTF-8) or raw bytes via hex/base64 input. - [Data URI Generator](https://elysiatools.com/en/tools/data-uri-generator): Convert files into Data URIs (Base64 or percent-encoded) for inlining images, fonts, and assets directly into HTML, CSS, or Markdown - [Hash Algorithm Comparator](https://elysiatools.com/en/tools/hash-algorithm-comparator): Hash the same input with MD5, SHA-1, SHA-256, SHA-512, BLAKE2b, and BLAKE3 at the same time and compare them side by side: output length, hex/Base64 digest, security status (broken / modern), and a relative speed benchmark. Great for teaching, choosing a hashing algorithm, or sanity-checking checksums. ## Samples - [Copyright-Free MP3 Audio Samples](https://elysiatools.com/en/samples/mp3-samples): Collection of royalty-free audio samples for testing and development purposes including nature sounds, meditation music, and ambient audio - [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion - [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion - [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion ## Related content - [Token, Session, and 2FA Workflow Tools](https://elysiatools.com/en/hubs/token-session-and-2fa-workflows): Debug real sign-in flows with PKCE and nonce generators, JWT and JWK inspectors, HMAC verification, OTP and TOTP testing, and auth-safe identifiers collected in one focused workflow hub. - [Text Case, Encoding, and Normalization Conversion Tools](https://elysiatools.com/en/hubs/text-convert): Compare text case conversion, character-width conversion, encoding conversion, quoted-printable handling, and inline text normalization tools in one hub. - [Text Tools](https://elysiatools.com/en/hubs/text-utility): Explore 33 text tools for utility workflows and compare closely related utilities quickly. - [Text Analysis, Readability, and Content Inspection Tools](https://elysiatools.com/en/hubs/text-analyze): Compare text statistics, language detection, readability scoring, sentiment analysis, moderation review, and pattern analysis tools in one hub.