Secret key generator

Generate a random secret key for an API, a JWT or HMAC signature, a session or a webhook: 16, 32 or 64 bytes of cryptographic randomness, written in hex, Base64 or Base64URL.

How long?

32 bytes (256 bits) suits HMAC-SHA256 and HS256 signing keys and API tokens; use 64 bytes for HS512. 16 bytes is enough for an identifier that must not be guessed.

Which encoding

Hex (0-9 and a-f) is twice as long as the bytes and safe anywhere. Base64 is shorter; Base64URL also avoids + / and =, so it can go into a URL, a header or an environment variable without escaping.

Common uses

  • JWT_SECRET for HS256: 32 bytes
  • Webhook signing secret (HMAC-SHA256): 32 bytes
  • Session or CSRF secret, Django SECRET_KEY, Rails secret_key_base: 32 to 64 bytes
  • An API key to hand out: 32 bytes in Base64URL

Private: made on your device

Everything is generated in your browser by its cryptographic random generator (crypto.getRandomValues), the one Web Crypto uses for keys. Nothing is sent anywhere and nothing is saved: copy what you need, and generating again or leaving the page discards the rest.

Questions

Can I use it as a JWT signing secret?

Yes: 32 bytes or more suits HS256. Check a token signed with it on the JWT decoder page (paste the JWT and type the secret below it).

Is it safe to make keys on a website?

These never leave your browser. For production keys, many teams still prefer to make them where they are used, such as with openssl rand -hex 32 on the server; both draw from a cryptographic generator.

More tools