OPENSSL-RAND(1ossl)

📦 version 3.5.0, in opensuse-leap 16.0

🌸 OPENSSL-RAND 🌸

okay so you found your way into the openssl-rand(1ossl) page, bestie, and honestly? iconic choice. this is the one that just hands you random bytes. like a little vending machine but for entropy. let's get into it 💅

✨ SYNOPSIS ✨

openssl rand [-help] [-out file] [-base64] [-hex] [-engine id] [-rand
files] [-writerand file] [-provider name] [-provider-path path]
[-provparam [name:]key=value] [-propquery propq] num[K|M|G|T]

that's the whole vibe. tiny command, big responsibility. 🫶

💖 DESCRIPTION 💖

so this command generates num random bytes using a cryptographically secure pseudo random number generator — a CSPRNG, say it with me — and yes the "cryptographically secure" part is doing a LOT of work there, we love her for it. 🔥

you can tack a suffix [K|M|G|T] onto the num value to say "hey, scale this as a multiple of KiB/MiB/GiB/TiB respectively." but — and this is the part people get wrong — suffixes are case sensitive, and they mean binary multiples. so K = 1024 bytes, M = 1024*1024 bytes, etc. lowercase k is not it, bestie, it will not slay. 😭

the string 'max' can be substituted for a numerical value in num if you want the maximum number of bytes the CSPRNG can produce per instantiation. and currently? that's restricted to 2^61 bytes as per NIST SP 800-90C. so, like, a lot. but not infinite. 🫠

the random bytes come from the RAND_bytes(3) function, which gives you a security level of 256 bits — provided it managed to seed itself successfully from a trusted operating system entropy source. if it didn't? the command fails with a nonzero error code. no cap. for more details, see RAND_bytes(3), RAND(7), and EVP_RAND(7).

lowkey important: if the seeding fails, you do NOT get sketchy half-random bytes. you get an error. that's the whole point. don't ignore the exit code. 💀

🎀 OPTIONS 🎀

  • -help — prints out a usage message. the "girl help" of flags, but make it documentation. 💖
  • -out file — writes to file instead of standard output. very demure, very file-based. 🎀
  • -base64 — performs base64 encoding on the output. for when raw bytes are too feral for your terminal. ✨
  • -hex — shows the output as a hex string. deadbeef girlies rise. 🔥
  • -engine id — see "Engine Options" in openssl(1). ⚠️ heads up: this option is deprecated. it's giving 3.0-era nostalgia, not main character energy. 💀
  • -rand files, -writerand file — see "Random State Options" in openssl(1) for the details. go read that one, i'll wait. 🦋
  • -provider name
  • -provider-path path
  • -provparam [name:]key=value
  • -propquery propq — see "Provider Options" in openssl(1), provider(7), and property(7). that's four options in one little group, we love efficiency. 👑

🌈 SEE ALSO 🌈

openssl(1), RAND_bytes(3), RAND(7), EVP_RAND(7)

like, go read them. they're the supporting cast and they understood the assignment. 💜

🦋 HISTORY 🦋

the -engine option was deprecated in OpenSSL 3.0. she had her moment, and her moment has passed. 🙈

Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, you're officially educated ✨ this was OPENSSL-RAND(1ossl) from OpenSSL 3.5.0, dated 2026-09-25 — now go generate your bytes and stay seeded, bestie 💅💖🌸

📦 where this page comes from