128-bit key (hex)
For AES-128 and short HMAC keys.
…
Free tool
Secure Key Generator
Encryption keys, JWT secrets, API keys, UUIDs and Wi-Fi passwords ready to copy. Created in your browser with cryptographic randomness.
Ready-to-use keys
Click “Copy” on the one you need. Each is generated when the page loads; use “Generate another” to renew it.
256-bit key (hex)
For AES-256, HMAC-SHA256 and JWT HS256 secrets.
…
512-bit key (hex)
For HMAC-SHA512 and JWT HS512 secrets.
…
256-bit key (Base64)
The same size in a shorter format, common in configurations.
…
256-bit secret (Base64URL)
Safe for URLs and headers: session tokens, CSRF and JWT.
…
Strong password (63 characters)
Letters, numbers and symbols for accounts you keep in a manager.
…
Wi-Fi WPA2/WPA3 password (63 characters)
The maximum allowed length, with only letters and numbers to make it easier to type.
…
256-bit WPA key (64 hex)
Pre-shared key in hexadecimal format for routers and access points.
…
API key (40 characters)
Letters and numbers, with no symbols that cause problems in URLs or headers.
…
Database password (32 characters)
Alphanumeric, for connection strings and environment variables.
…
UUID v4
Random unique 128-bit identifier.
…
Django SECRET_KEY (50 characters)
With the same alphabet Django uses to generate it.
…
Laravel APP_KEY
32 random bytes in Base64 with the base64: prefix.
…
Custom key
Choose the format, the size and how many you need.
Generated in your browser. Nothing is sent or stored anywhere.
Are these keys secure?
Everything happens on your device: you don't have to take our word for it.
Cryptographic randomness
We use your browser's secure generator (Web Crypto, crypto.getRandomValues), the same one used for encryption keys. We never use Math.random.
Nothing leaves your browser
The keys are created by this page's code and are not sent to any server or stored. You can check this in the Network tab of the developer tools.
No bias
Each character is chosen with unbiased sampling, so all possible values are equally likely.
How to use and store a key
Don't push it to Git
Keep keys in environment variables or a secrets manager, never in the code or in a repository, not even a private one.
A different key for each environment
Use different keys in development, testing and production, and for each service, to limit the damage if one leaks.
Sufficient size
256 bits is the norm for AES-256 and HMAC-SHA256. Keys shorter than 128 bits are no longer considered secure for encryption.
Rotate your keys
Change them if you suspect they've been exposed, when someone with access leaves the team, and periodically in critical systems.
WEP is obsolete
Some generators still offer WEP keys. It's an encryption that has been broken for years: use WPA2 or WPA3 on your Wi-Fi.
Frequently asked questions
Do you store the keys I generate?
No. They are generated in your browser and are not sent to our servers or to third parties. If you close or reload the page, they disappear.
What's the difference between hex, Base64 and Base64URL?
They are ways of writing the same random bytes. Hex uses 0-9 and a-f and is the longest; Base64 is shorter; Base64URL replaces the + and / characters so that it is valid in URLs and headers.
What key size do I need for a JWT?
For HS256, at least 256 bits (32 bytes); for HS512, 512 bits (64 bytes). Short keys allow brute-force attacks.
Can I use this as an account password?
Yes, the strong 63-character password works for accounts you keep in a manager. If you need to adjust the length or the type of characters, use our password generator.
What is a UUID v4?
It's a random 128-bit identifier in a standard format. It's fine for identifying records, but not for use as an encryption secret.
Can my keys be cracked because the site is online?
No. The keys never travel over the network, so nobody sees them. That said, treat them as secrets: don't paste them into sites you don't control.
Do you need help with the security of your website or your application?
Tell us how you work and we'll tell you what to strengthen first, no strings attached.