openssl-rand

Generate pseudo-random bytes

TLDR

Generate 32 random bytes as hexadecimal

$ openssl rand -hex [32]

Generate 24 random bytes as Base64

$ openssl rand -base64 [24]

Write 256 random bytes to a file

$ openssl rand -out [path/to/file] [256]

Generate a random password (16 bytes, Base64 encoded)

$ openssl rand -base64 [16]

openssl rand [-help] [-out file] [-base64] [-hex] [-engine id] [-rand files] [-writerand file] [-provider name] [-provider-path path] [-propquery propq] num

DESCRIPTION

openssl rand generates a specified number of pseudo-random bytes using a cryptographically secure pseudo-random number generator (CSPRNG). It calls RAND_bytes(3) internally, which provides 256-bit security strength when properly seeded from the operating system's entropy source.The output can be written as raw binary, Base64-encoded, or hexadecimal. Common uses include generating random passwords, encryption keys, initialization vectors, and nonces for cryptographic operations.

PARAMETERS

-help

Print usage message and exit.

-out file

Write output to file instead of standard output.

-base64

Encode the output using Base64.

-hex

Display the output as a hexadecimal string.

-engine id

Specify an engine for random generation (deprecated in OpenSSL 3.0).

-rand files

Specify additional random data source files.

-writerand file

Write random state to file on exit.

-provider name

Specify the provider to use for random generation.

-provider-path path

Path to search for providers.

-propquery propq

Property query for provider selection.

_num_

The number of random bytes to generate (required).

CAVEATS

The command fails with a nonzero exit code if the CSPRNG cannot be properly seeded from the operating system's entropy source. When using -base64, the actual output is larger than num bytes due to Base64 encoding expansion (roughly 4/3 ratio plus line breaks). The -engine option is deprecated as of OpenSSL 3.0 in favor of the provider-based architecture.

HISTORY

openssl rand has been part of OpenSSL since at least version 0.9.x (circa 2000). The -engine option was deprecated in OpenSSL 3.0 (released 2021), which introduced the provider-based architecture as a replacement. OpenSSL itself was started in 1998 as a fork of SSLeay.