External ID Generator

Third-party cross-account access in AWS almost always needs an External ID, but the value itself is easy to get wrong in a way that quietly defeats its own purpose: typing a short, memorable, or predictable string undermines the exact guarantee AWS designed the External ID condition to provide. External ID Generator produces a genuinely unpredictable value using the browser's cryptographically secure random number generator, so the value you paste into a trust policy actually resists guessing.

The generator draws 256 bits (32 bytes) from window.crypto.getRandomValues() - the Web Crypto API backed by the operating system's CSPRNG - rather than Math.random(), which is explicitly not designed to be unpredictable and should never be used for anything where guessability matters. Those random bytes are then encoded as either lowercase hex (64 characters, digits and a-f only) or base64url (43 characters, using the full base64url alphabet without padding), your choice, with both encodings carrying the identical amount of real entropy.

AWS documents the External ID as the standard mitigation for the confused-deputy problem: when a third-party service is given a role ARN to assume on behalf of multiple customers, requiring each customer's calls to also present a unique, hard-to-guess External ID via a StringEquals condition on sts:ExternalId prevents one customer's intermediary from being tricked (or misused) into accessing a different customer's resources through the same role. The External ID is not a password and does not replace the Principal check in a trust policy - it is an additional required condition layered on top of an already-scoped trust relationship, so it only strengthens a correctly-configured trust policy, it cannot make an overly broad one safe on its own.

A snippet below the generated value shows exactly how the value fits into a trust policy's Condition block, built with the same condition-assembly logic the site's trust-policy generator tools use, so what you see here is guaranteed to match the shape those tools produce. Give the generated External ID to whichever third party or automation needs it, and add the matching condition to the target role's trust policy using the IAM Trust Policy Generator or IAM Role Trust Relationship Generator elsewhere in this category.

• Cryptographically secure randomness via window.crypto.getRandomValues(), never Math.random().
• 256 bits (32 random bytes) of entropy per generated value.
• Hex or base64url encoding, your choice, both carrying identical entropy.
• Live trust-policy Condition snippet showing exactly how the value fits into a real trust policy.
• One-click regenerate for a fresh value.
• Copy button for both the raw value and the condition snippet.
• 100% client-side - the value is never transmitted anywhere.

1. Choose an encoding - hex or base64url.
2. Click Generate to produce a fresh cryptographically random External ID.
3. Copy the value and give it to the third party or automation that needs it.
4. Copy the Condition snippet and add it to the target role's trust policy - or use the IAM Trust Policy Generator / IAM Role Trust Relationship Generator, which both have a dedicated External ID field.
5. Regenerate any time you need a fresh, independent value for a different third party.

Example 1 - hex encoding. A 64-character lowercase hex string such as 3f9a1c... (64 hex digits), suitable for pasting into any system without special-character concerns.

Example 2 - base64url encoding. A shorter 43-character string using letters, digits, - and _, carrying the same 256 bits of entropy in less visual space.

Example 3 - condition snippet. Generating a value and copying the snippet produces exactly "Condition": {"StringEquals": {"sts:ExternalId": "<your generated value>"}}, ready to merge into a trust policy's Statement.

• Actually unpredictable - sourced from a real CSPRNG, not a UI-grade random function.
• Matches the exact condition shape the site's trust-policy tools produce.
• No format guesswork - both offered encodings are safe to paste anywhere.
• Private - the value never leaves your browser.