Session ID Generator

Draw a random session ID in hex, Base64 or Base32, with enough randomness behind it that nobody can guess their way into another session. It is drawn on your device and never leaves your browser.

A session ID is what keeps somebody signed in: your server hands one out at login and treats whoever sends it back as that person. So it has to be nothing but chance — never a user number, a timestamp or a counter, all of which the next visitor can work out. This draws one on your device, in the encoding your cookie or framework expects.

Your session ID

Strength256 bitsStrong

Customize

Encoding

HexDigits and a–f. Read by anything, and the longest of the three.Base64 (URL-safe)Letters, digits, - and _. The same randomness in fewer characters.Base32No 0, 1 or 8, so nothing is misread. For an ID someone reads out.

All three write down the same random bytes, so the encoding changes how long the ID looks and nothing about how hard it is to guess. Pick whichever one the thing storing it accepts.

Randomness32

8 bytes64 bytes

Each byte is 8 bits of chance, and this is the only setting that affects strength. 16 bytes (128 bits) is the level a session ID is expected to reach; 32 is what most session libraries hand out, and the extra characters cost you nothing.

Characters used

0123456789abcdef

All 16 are safe in a cookie value and in a URL, so the ID travels without anything having to be escaped along the way.

ID length

32 bytes written in Hex64 characters

Worth checking against whatever stores the ID — a cookie has a size budget, and a database column has a width — but never a reason to drop below 16 bytes of randomness.

Recent IDs

Nothing here yet. IDs you generate are kept on this device only, so you can pick one up again if you close the tab before using it.

What makes a session ID safe

One thing only: how many IDs the one you are holding could have been. Every byte here is drawn separately, so 32 bytes come to exactly 256 bits. 128 bits is the point below which guessing stops being unthinkable, and 256 — that is 32 bytes — is what the common session libraries settle on. Nothing about the shape of an ID adds to that. One built from a user number, the time of day or a counter is weaker no matter how long it looks, because whoever works out the recipe can then write down everybody else's.

The encoding is a way of writing the bytes down, not a source of strength. The same 32 bytes are 64 characters in hex, 52 in Base32 and 43 in Base64 — three lengths, one level of difficulty for anyone trying to guess it. Choose by what has to read the ID, and leave the strength to the slider above.

What you do with it afterwards matters as much as how it was drawn. Send it in a cookie marked HttpOnly, Secure and SameSite rather than in a URL, where it ends up in browser history and in the referrer of every link. Issue a fresh one the moment somebody signs in, so an ID handed to them beforehand is already dead. Give it an expiry, and let signing out actually delete it on the server instead of only in the browser.

Nothing here is registered with anyone. An ID becomes real only when your own server stores it against a session, so generating another is the whole cost of losing one before then.

Everything happens on your device. Your session IDs never leave this browser.