~/envtools
tool

OpenSSL Rand Generator

The browser equivalent of openssl rand -base64 32. Choose your byte count and encoding — the output matches OpenSSL exactly. No terminal required.

Encoding
Bytes
Equivalent CLI command
openssl rand -base64 32
Output
Common use cases
openssl rand -base64 32— AUTH_SECRET, NEXTAUTH_SECRET
openssl rand -hex 32— API tokens, webhook secrets
openssl rand -base64 16— CSRF tokens, short-lived codes
openssl rand -hex 16— RAILS_MASTER_KEY

What does openssl rand do?

openssl rand reads from the operating system's cryptographically secure random number generator (CSPRNG) — /dev/urandom on Linux and macOS, BCryptGenRandom on Windows — and outputs the result in the encoding you specify.

This tool uses crypto.getRandomValues(), the browser's CSPRNG, which draws from the same OS source. The output is statistically equivalent to OpenSSL's — there is no practical security difference.

base64 vs hex — which to use?

  • base64 — more compact (33% shorter than hex for the same bytes). Used by Auth.js (AUTH_SECRET), Django password hashers, and most HMAC signing keys. Output contains +, /, and = padding — quote the value in your .env if it contains special characters.
  • hex — longer but URL-safe and shell-safe without quoting. Used by Rails (SECRET_KEY_BASE, RAILS_MASTER_KEY), API tokens stored in databases, and webhook secrets.

Common commands and what they're for

  • openssl rand -base64 32 — 32 random bytes → 44-char base64. Used for AUTH_SECRET, SESSION_SECRET, symmetric encryption keys.
  • openssl rand -hex 32 — 32 random bytes → 64-char hex. Used for API tokens, webhook secrets, database tokens.
  • openssl rand -hex 16 — 16 random bytes → 32-char hex. Used for RAILS_MASTER_KEY, AES-128 keys, short tokens.
  • openssl rand -base64 48 — 48 random bytes → 64-char base64. Used for HS384 JWT secrets.

Related tools