Random Secret Key Generator
Generate high-entropy random keys for APP_KEY, JWT secrets, and secure application credentials.
Runs in your browser Your input never leaves your device.
Report a problem with this tool
About this tool
Generate a random secret key of a chosen length in hex or Base64. Pick the number of bytes (8 to 256, default 32) and the format, then press Generate. The key is made in your browser with the Web Crypto random number generator and is never sent to a server. Hex output has two characters per byte, so 32 bytes gives 64 characters. Base64 output is the standard alphabet with padding. Use it for application keys, signing secrets and similar values.
How to use it
- Choose the number of bytes (32 is a common choice).
- Select Hex or Base64.
- Press Generate and copy the key.
- Store it in a secrets manager or environment variable, not in source control.
How long should a secret key be?
Each byte is 8 bits of randomness, so the default 32 bytes is a 256-bit key. That is enough for signing secrets and symmetric encryption keys used today.
For a JWT signed with HS256, the JWT standard (RFC 7518) requires a key at least as long as the hash output, which is 256 bits or 32 bytes. Use at least 48 bytes for HS384 and 64 bytes for HS512.
Choose the format your software expects. Hex uses only 0-9 and a-f, which is safe to paste anywhere. Base64 is shorter but contains + / and = characters, which need encoding inside a URL.
Recipes for common frameworks
- Laravel APP_KEY
- Generate 32 bytes in Base64 and add the prefix yourself: APP_KEY=base64:<key>. The framework's own command, php artisan key:generate, does the same.
- JWT secret (HS256)
- Generate 32 bytes or more and store it as an environment variable such as JWT_SECRET. Every service that verifies the token needs the same value.
- Django SECRET_KEY, Flask SECRET_KEY, session secrets
- Any long random string works. 32 to 64 bytes in hex is a simple choice.
- Webhook signing secret
- Generate 32 bytes in hex and share it with the sender through a secure channel.
The same key from the command line
If you prefer to generate keys on your own machine, these commands produce the same kind of output:
openssl rand -hex 32
openssl rand -base64 32
python3 -c "import secrets; print(secrets.token_hex(32))"
node -e "console.log(require('crypto').randomBytes(32).toString('base64'))" Common problems
- Key length differs from what you asked
- The length is in bytes, not characters. 32 bytes is 64 hex characters or 44 Base64 characters. Values outside 8-256 are clamped.
- Your framework rejects the key
- Some frameworks expect a specific format or prefix, such as Laravel's "base64:" prefix for APP_KEY. Add the prefix yourself if required.
- Key was shared by accident
- Generated keys are not stored anywhere. If a key leaks, generate a new one and rotate it everywhere it is used.
Frequently asked questions
Is it safe to generate a secret key online?
The key is created by your browser's Web Crypto random number generator and is not sent to our server or stored. If your policy forbids keys made in a browser, use one of the command-line options on this page.
What is the difference between a secret key and a password?
A password is chosen to be typed by a person. A secret key is read only by software, so it can be long and fully random. Use the Password Generator for passwords.
Should I use the same key in development and production?
No. Generate a separate key for each environment so a leaked development key cannot sign or decrypt production data.