Why Use This Tool?
API secrets, encryption keys, and webhook signing keys all need to be cryptographically random. This generator uses your browser's crypto.getRandomValues to produce keys that are suitable for production use — not just random-looking strings.
Choose your byte size and output format: 32 bytes is the standard for HMAC-SHA256 keys, 16 bytes for AES-128. The hex output is lowercase and ready to paste into environment variables or config files.
How It Works
- Set the key size in bytes (32 is the common default).
- Choose the output format — hex, Base64, or Base32.
- Generate and copy as many keys as you need.
What Is a Cryptographic Key?
A cryptographic key is random data used by an algorithm to encrypt, decrypt, or sign data. Key quality is entirely dependent on randomness — any pattern makes the key weaker regardless of the algorithm's strength.
Common Use Cases
- API secret keys and webhook signing
- JWT signing secrets
- Encryption keys for data at rest
- Session token generation
Frequently Asked Questions
What key size should I use?
32 bytes (256 bits) is the standard for symmetric encryption and HMAC-SHA256. 16 bytes suits AES-128. 64 bytes is generous for HMAC-SHA512.
What's the difference between hex and Base64 output?
Same bytes, different text encoding. Hex uses 2 characters per byte (longer but always safe in any context); Base64 packs 3 bytes into 4 characters (shorter but may contain + and /).
Are these keys safe for production?
Yes — they come from your browser's cryptographic random source (crypto.getRandomValues), which is the same quality used for security tokens.
Can I use these keys for encryption?
Yes — the raw bytes are suitable for any symmetric encryption algorithm. Just decode them from the displayed format before use.
Tips & Things to Watch
- 32 bytes is the sweet spot for most uses — 256 bits of security.
- Generate more than you need and pick randomly for extra paranoia.
- Store keys in environment variables, never in source code.
- Rotate keys periodically — even good keys shouldn't last forever.