Skip to main content
Back to Numbers generators

Numbers

Random Base64 String Generator

Used by developers, writers, and creators worldwide.

A random Base64 string generator produces cryptographically random bytes and encodes them into compact, printable strings suited for application secrets, signing keys, and tokens. Base64 output embeds safely in JSON configs, `.env` files, and HTTP headers without special handling. The security lives in the raw byte count — a 32-byte string carries 256 bits of entropy regardless of how it looks on screen. Adjust byte length to match your use case: 32 bytes covers Django `SECRET_KEY`, Express session secrets, and AES-256 keys; 64 bytes suits HMAC-SHA512. Toggle URL-safe mode to swap `+` and `/` for `-` and `_`, making the output paste-ready into query parameters, cookies, and JWT compact serialization. Generate up to a batch at once for secret rotation or test fixture seeding.

Loading usage…

Free forever — no account required

How to use

  1. Choose your options above
  2. Click Generate
  3. Copy your result

Detailed instructions

  1. Set the byte length to 32 for standard secrets, or 64 for HMAC-SHA512 keys.
  2. Set the count to how many independent strings you need in one batch.
  3. Toggle URL-safe to Yes if the string will appear in a URL, filename, or JWT.
  4. Click Generate to produce the list of encoded strings.
  5. Copy the string you want and paste it directly into your .env file or config.

Use Cases

  • •Setting Django SECRET_KEY or Flask secret_key in a production .env file
  • •Generating a 64-byte HS512 signing secret for a Node.js JWT authentication service
  • •Creating URL-safe password-reset tokens to embed directly in emailed links
  • •Pre-seeding a Cypress test suite with distinct 32-byte AES-256 key fixtures
  • •Producing webhook signing secrets for Stripe or GitHub payload verification

Tips

  • →For .env files, 32 bytes is the sweet spot — long enough to be secure, short enough that most env parsers handle it without line-wrap issues.
  • →If your framework checks secret length at startup (e.g., Django warns below 50 characters), use 40 bytes to comfortably clear that threshold.
  • →URL-safe mode is always safe to use even when you don't strictly need it — the character set is valid everywhere standard Base64 is.
  • →Generate at least three strings when rotating a secret, so you have immediate backups if the first one causes an unexpected conflict.
  • →Avoid trimming or shortening the output — each character contributes to entropy, and manually cutting a string can introduce subtle patterns.
  • →When using a generated string as a cookie secret, confirm your cookie library handles Base64 characters without additional escaping before deploying.

FAQ

how many bytes should a base64 secret key be

32 bytes (256 bits) covers most use cases including AES-256, HMAC-SHA256, and standard web framework secrets like Django's SECRET_KEY. Go to 64 bytes for HMAC-SHA512. Avoid anything under 16 bytes for security-sensitive values — the entropy is too low.

is base64 encoding the same as encryption

No — Base64 is a reversible encoding, not encryption. Anyone can decode it instantly. The security here comes entirely from the randomly generated bytes underneath, not from the encoding format itself. Never treat Base64 output as obfuscated or protected data.

when do I need url-safe base64 instead of standard

Use URL-safe mode whenever the string will appear in a URL query parameter, cookie, or filename — standard Base64's `+` and `/` characters are reserved in those contexts and will break without percent-encoding. The JWT compact serialization spec also requires URL-safe Base64 by default.