Entropy-Based Random Seed Generator
Generate a cryptographically secure 256-bit seed, anchored in your browser's Web Crypto API and mixed with your mouse and keyboard activity.
100% client-side · No Math.random() anywhere in this tool
Optional - a cryptographically secure seed is already available without this.
Store a seed you intend to use somewhere sensitive offline, and never share or transmit it.
How This Seed Is Actually Generated
The browser's Web Crypto API - crypto.getRandomValues() - is a cryptographically secure random number generator built into every modern browser, and it is the real source of security here: 32 fresh bytes from it are mixed in automatically when the page loads and again each time you click Generate. Mouse movement, keystroke timing and (where available) device orientation are mixed in on top as supplementary, unpredictable input - a reasonable extra, not the foundation. Everything is compressed through SHA-256 to produce a fixed 256-bit (32-byte) output. Math.random(), which is not cryptographically secure, is never used anywhere in this tool, including in its error-handling paths.
Web Crypto, Not Math.random
The seed is anchored in crypto.getRandomValues() and SHA-256 - Math.random() is never used
Interaction Mixed In
Mouse movement and keystrokes are mixed into the pool as supplementary unpredictability
Honest About the Meter
The collection meter shows bytes gathered, not a fabricated bit-strength claim
Three Output Formats
Hex, Base64 and decimal, ready to paste into most languages and tools
No Silent Downgrade
If your browser lacks the Web Crypto API, the tool says so and refuses to generate rather than quietly using weaker randomness
Privacy First
Everything runs in your browser. Nothing is uploaded or stored
Explore more free tools in our security tools collection, including our strong random password generator.
Frequently Asked Questions
1. Where does the actual security of this seed come from?
From your browser's Web Crypto API - specifically crypto.getRandomValues(), a cryptographically secure random number generator (CSPRNG) built into every modern browser. 32 bytes from it are mixed into the pool automatically when the page loads, and 32 more are added fresh each time you click Generate, then everything is hashed with SHA-256. That CSPRNG material is what makes the output unpredictable. Your mouse and keyboard activity adds further unpredictable input on top, but it is not the foundation - you would get a cryptographically sound seed even if you generated one the instant the page loaded, without touching your mouse.
2. Why doesn't the page show a precise 'bits of entropy' number for my mouse movements?
Because a believable number would need real entropy estimation, and a simple multiplier does not provide that. A byte from crypto.getRandomValues() carries close to 8 bits of unpredictability; a byte from a mouse coordinate carries much less, since positions are bounded by your screen and strongly correlated with the previous position. Treating every collected byte as equally random and multiplying by a fixed factor overstates how unpredictable the interaction data really is. This tool shows how many bytes it collected instead of a bit count it cannot actually justify.
3. Is this seed suitable for generating a cryptocurrency wallet or private key?
The output is a cryptographically sound 256-bit value whenever your browser supports the Web Crypto API (the tool refuses to generate and tells you plainly if it doesn't), so it is a reasonable source of entropy for that purpose. For anything protecting real funds, also follow your wallet hardware or software's own entropy generation and verification process rather than relying on a browser tool alone, generate and use it on a secure, offline device, and never share or transmit the seed.
4. Does this meet an official standard like NIST SP 800-90?
No certification or formal testing against that standard has been done here, so that claim is not made. The design follows standard practice - a CSPRNG seed combined with supplementary input, compressed through SHA-256 - which is a reasonable and common approach, but 'reasonable approach' and 'certified compliant' are different things.
5. What happens if my browser doesn't support the Web Crypto API?
The Generate button is disabled and the page explains why, rather than silently switching to Math.random() or another non-cryptographic fallback. Every modern browser over HTTPS supports the Web Crypto API, so this should be rare, but a security tool should never quietly produce weaker output while still calling it secure.
6. What output formats are available, and how do I use them?
Hexadecimal (e.g. a7f3c9e2...) is the most common format for keys and API secrets, and works directly with Python's int(seed_hex, 16) or similar. Base64 is compact and common in config files and tokens. Decimal is a plain big integer, useful for seeding a PRNG that expects a numeric seed. All three represent the exact same 256-bit value.
7. Is my data stored or sent anywhere?
No. The entropy pool and every seed you generate exist only in your browser's memory while the page is open, and are cleared on reset or reload. Nothing is sent to a server, and nothing is written to local storage.
8. Do I need to move my mouse before generating a seed?
No. A cryptographically sound seed is available as soon as the page loads, since it already includes fresh Web Crypto API bytes. Moving your mouse or typing adds extra unpredictable input to the mix, which doesn't hurt, but isn't required for the output to be secure.