Random Hex Generator

What this tool is used for

• Producing a random hex string to use as a token, a nonce or a request identifier.
• Generating a colour value at random while exploring a palette.
• Creating a fixed-length identifier for a test that needs unpredictable input.
• Producing random bytes in hex for a protocol field that expects them.
• Generating a salt or an IV in the encoding a config file accepts.

Frequently Asked Questions

Why generate hex rather than alphanumeric?

Hex maps exactly onto bytes — two characters per byte, no encoding ambiguity — which is what cryptographic material, colour values, MAC addresses and memory dumps all expect. An alphanumeric string does not have a clean byte boundary.

How many hex characters do I need for N bits?

Divide by four: each hex digit carries exactly 4 bits. 32 characters is 128 bits, 64 characters is 256 bits. This exactness is the main practical reason to prefer hex when a spec states a bit length.

Does uppercase or lowercase matter?

Not for value — 0xFF and 0xff are identical. It matters for string comparison: hashes are conventionally lowercase, CSS colours are commonly uppercase, and comparing across the two without normalising is a real bug.

Can I use this for an AES key?

Yes: 32 hex characters for AES-128, 64 for AES-256, generated with crypto.getRandomValues. Remember the key is the hex-DECODED bytes — passing the ASCII text of the hex string as the key is a classic and severe mistake.

Is a random hex string a valid colour?

Any 6 hex digits is a syntactically valid #RRGGBB colour, but random colours cluster in muddy mid-tones and rarely give usable contrast. For UI work a palette generator constrained by lightness is the better tool.

Is a hex string case-sensitive when compared?

Not as a value, but yes as text. `AB` and `ab` are the same bytes and different strings, so a token compared with `===` after being normalised differently at either end fails for a reason that looks impossible.

How does hex compare with base64 for the same entropy?

Hex costs two characters per byte; base64 costs about 1.33. For a 32-byte value that is 64 characters against 44 — hex is chosen for readability and unambiguous parsing, not for compactness.

Common errors and gotchas

• Assuming a hex string's length is its entropy. Two hex characters carry one byte, so 32 characters is 128 bits.
• Using a generated value as a password, when hex has only 16 symbols and is longer than it needs to be.
• Reusing a value that was meant to be per-request, which defeats the purpose of a nonce.
• Treating the output as secret after it has been pasted into a URL, a log or a ticket.
• Confusing a random hex string with a hash, which is derived from input rather than generated.