OpenSSL Cheatsheet

Generate a random Base64URL or hexadecimal secret on your own machine.

Base64URL secret

macOS / Linux (POSIX shell)

$openssl rand -base64 32 | tr '+/' '-_' | tr -d '=\n'

Windows PowerShell

PS>(openssl rand -base64 32)
  .Replace('+', '-')
  .Replace('/', '_')
  .TrimEnd('=')

What the command returns

OpenSSL generates 32 random bytes (256 bits) Base64-encoded, then it is converted to Base64URL.

Hexadecimal secret

$openssl rand -hex 32

OpenSSL generates 32 random bytes (256 bits) in hexadecimal. Hex is longer than Base64URL for the same randomness.

References

OpenSSL rand documentation describes random-byte generation and Base64 output.
RFC 4648, section 5 defines the URL-safe Base64 alphabet.