Random Key and Bytes Generator

Five of the six formats are the same bytes wearing different clothes

Hexadecimal, Base64, URL-safe Base64, Base32 and the decimal byte array are all reversible encodings: nothing is added and nothing is lost, so running any of them backwards recovers the exact bytes. Pushing all 65,536 two-byte inputs through each one gives 65,536 distinct outputs every time, which is what “reversible” means when you check it rather than assert it. So a 32-byte key holds 256 bits of randomness in every one of them. What changes is how many characters that takes.

Base64 is the densest of the reversible four, because 6 bits is the most you can pack into a character while staying inside a printable, case-sensitive alphabet with barely any punctuation. URL-safe Base64 comes out one character shorter only because it strips the padding. Base32 gets 5 bits per character rather than 6 because it draws on only 32 symbols: the 26 letters plus the digits 2 to 7. That makes it case-insensitive and leaves out 0, 1, 8 and 9 — the digits most easily misread as O, I, B and g — at the cost of a longer string.

The sixth is not an encoding, and this page used to report it wrongly

“Letters and digits” does something different. It takes each random byte and maps it onto one of 62 characters, discarding bytes of 248 and above so the 62 stay equally likely. That rejection is done correctly — 248 is exactly 4 × 62, so every character is reachable from exactly 4 byte values, and only 8 of the 256 are thrown away. Skipping that step and taking the byte modulo 62 directly would quietly favour the first eight characters. But it discards information on purpose. A byte carries 8 bits; a character out of 62 carries log₂(62) = 5.954. And the output is one character per input byte, so 32 bytes come out as 32 characters holding 190.5 bits rather than 256.

A shortfall of 25.57%, identical at every size, because it is a fixed ratio of 5.954 to 8. The entropy readout on this page reported bytes × 8 for every format — right 5 times out of 6 and overstating the sixth by a third. It now computes the figure per format, so choosing “Letters and digits” at the 256-bit preset shows 190.5 bits.

None of which makes the output weak. 191 bits is far past anything brute force will ever reach, and the reason to want letters and digits is usually that some other system refuses punctuation. It made the number on the screen wrong, which is a different problem. If you want a true 256 bits out of that alphabet you need 43 characters — the same length URL-safe Base64 reaches from a smaller alphabet, and 22 characters is where it clears 128 bits.