Secret Key Generator
Free secret key generator: make random API keys, JWT secrets and encryption keys of 128 to 512 bits in hex, Base64, Base32 or a custom alphabet, with a prefix.
How to use Secret Key Generator
- 1Pick a strength in bits or set a length in bytes, then choose the output format.
- 2Add a prefix if you want one and set how many keys you need.
- 3Copy a single key, copy them all or download the list, and store it in a secrets manager.
What makes it better
- 128 to 512 bits, or 8 to 128 bytes
- Hex, Base64, Base64URL, Base32, alphanumeric or a custom alphabet
- Prefix support such as sk_live_ for API keys
- No modulo bias for alphabets that are not a power of two
- Entropy shown, with copy for each key and for all
About Secret Key Generator
Secret Key Generator creates random keys and tokens from your browser's cryptographic random number generator. Choose a strength from 128 to 512 bits, an output format such as hex, Base64URL or alphanumeric, an optional prefix like sk_live_, and up to 50 keys at once. The entropy of each key is shown, and nothing you generate is sent anywhere.
Common uses
- Create a 256-bit secret for signing JWTs with HS256, which needs at least 256 bits.
- Generate API keys or webhook signing secrets with a recognisable prefix.
- Make a session secret, cookie key or encryption key for an app's environment file.
- Produce a batch of one-off tokens for tests or staging environments.
Example
Input
256 bits, Hex, one key (sample only: every key you generate is new)
Result
9f3c1a7e5b2d48c0a6e1f4739d8b52ce0147a9d6b3f58e2c7104da96e8b3f5a1
Good to know
- Use a new key for every purpose and never reuse one across services. Keep keys in a secrets manager or environment variables, not in source control.
- A key is only as private as the place it is shown: anyone who can see your screen, clipboard or browser extensions could copy it. Rotate a key if you suspect exposure.
- A prefix and an encoding add no security. Only the random part counts, and the entropy figure shown excludes the prefix.
Secret Key Generator FAQ
How long should a secret key be?
256 bits (32 bytes) is the usual choice for symmetric keys and HS256 JWT secrets. 128 bits is the floor for anything guarded by an attacker's guessing speed; going to 512 bits costs nothing but length.
Which format should I choose for an API key?
Hex or Base64URL are safe in headers, URLs and config files. Alphanumeric is easiest to copy and read out loud, while Base64 can contain + and /, which sometimes need escaping.
How is the alphanumeric or custom alphabet output kept unbiased?
Random values that fall outside the largest even multiple of the alphabet size are thrown away and drawn again. A plain modulo would make some characters slightly more likely than others.
How do I calculate the entropy of a custom alphabet?
Multiply the number of characters by log2 of the number of different symbols. The tool picks enough characters to reach at least the bits you asked for and shows the exact result.
Is it safe to generate production keys in a browser?
The numbers come from crypto.getRandomValues, the same source browsers use for TLS, and they never leave the page. For high-value keys, generate them on the machine that will use them, such as with a hardware module.