Secret Key Generator

Random keys and secrets made right in your browser, without openssl rand

Values are created inside this browser only.
They are generated with the browser's crypto.getRandomValues(), and they are not sent to a server, not stored, and not logged. Nothing is left in the address bar (URL) or in browser storage either, so the values are gone once you close this page. Keeping the values you have copied safe is your own responsibility.

This tool needs JavaScript because it generates the random numbers in your browser. Please turn JavaScript on and open this page again.

Key Size (bytes)

Manual Input

You can set anywhere from 8 to 512 bytes. The default of 48 bytes is the same length as openssl rand -base64 48.

Base64

Standard Base64. It uses uppercase and lowercase letters, digits, and + /. This is the most common form to paste straight into an environment variable or a config file.

Hex

Hexadecimal. It uses only 0-9 and a-f, so it never needs escaping wherever you put it, but for the same number of bytes it is the longest of the three.

Base64URL

The form with + / replaced by - _ and the padding (=) stripped. You can put it straight into a URL, a cookie value, or a JWT with no extra encoding.

Bytes and characters are not the same thing

What decides the strength of a key is the number of bytes, not the number of characters. 48 bytes is 384 bits of randomness, and written out in Base64 it becomes 64 characters. Calling that 64-character string a "64-byte key" makes it look stronger than it is, so this tool always shows both numbers together.

The same 48 bytes, written out in each format

Format	Characters at 48 bytes	Characters used
Base64	64 characters	`A-Z a-z 0-9 + /`
Hex	96 characters	`0-9 a-f`
Base64URL	64 characters	`A-Z a-z 0-9 - _`

Base64 writes 3 bytes as 4 characters. That is why it comes out evenly, with no padding (=), only when the byte count is a multiple of 3. 48 is a multiple of 3, so it gives exactly 64 characters; a length that is not a multiple of 3, such as 32 bytes, gets = at the end.

How many bytes should you use, and where

Usage	Recommended length	Recommended format
Session secret · cookie signing key	32 bytes	Base64
JWT signing key (HS256)	32 bytes	Base64URL
API key · webhook verification token	32 bytes	Base64URL
AES-256 key	32 bytes	Hex
When you want extra margin (default)	48 bytes	Base64

Past 32 bytes (256 bits), guessing a key by brute force becomes practically impossible. Going longer than that is mostly just margin and makes no real difference in strength, so it is better to spend your time on where and how you store the key than on making it longer.

Why generate in the browser instead of on the server

If a server generated the key and sent it down, that value could be left behind in the server access log, in an intermediate proxy, or in an error tracking tool. Once it is left anywhere, even once, the key is no longer a secret. This tool generates in the browser so that the value never goes out onto the network at all.

The random numbers come from crypto.getRandomValues(). It is a cryptographically secure source provided by the operating system, so the next value cannot be predicted. Math.random() is predictable and must not be used to generate keys; this tool does not use it.

If you want to check for yourself, open the Network tab in your developer tools and press Generate New. No request is made at all. You can also save this page and open it with no internet connection, and it works exactly the same.

Back to Tool List