OnePassword

Developer Tools

The seven that end up in a config file, a database column or a request header — rather than in somebody's memory.

Last updated 7 tools

What this page is

Not a category of its own, but a cross-section. These seven are drawn from Random Generators and Keys & Secrets on one criterion: the value ends up somewhere in a system rather than in a person's head.

Everything a human has to remember lives under Password Tools instead.

Where each one ends up

It goes inUse
An environment variable your app signs withSecret Key or JWT Secret
A request header a client sends youAPI Key
A column next to a password hashSalt
A primary key or an event IDUUID
A test fixture, a seed, a throwaway tokenRandom String
A checksum you are verifying by handHash

Why in-browser matters more here

A generator that runs on a server has to receive the value before it can show it to you. For a throwaway string that is merely untidy. For a signing key that is about to protect every session your application issues, it means the key existed somewhere you cannot audit before it ever reached you.

Everything on this site is produced by crypto.getRandomValues() in your own browser. There is no request to log, no database row and no backup — which is a property of the architecture rather than a promise, and the privacy page explains how to confirm it in about a minute.

Two things that are deliberately missing

There is no API. An API means a server, and a server means your key material travelling somewhere before you see it. If you need generation inside a build step, your language's standard library already has a cryptographically secure random source — that is the same thing these pages call.

There is no file hashing either. shasum -a 256 and Get-FileHash already do it offline, without a web page in the middle.

Which specification each one follows

  • UUID — RFC 9562, including the v7 monotonic counter in §6.2.
  • JWT Secret — RFC 7518 §3.2, which makes the minimum key size a MUST.
  • Salt — RFC 9106 §3.1 for the 16-byte recommendation.
  • Random Code — Crockford's Base32, for the readable alphabet and the check symbol.
  • Hash — RFC 1321's own test vectors for MD5; the browser's implementation for SHA.

Where a page quotes a specification it links to it and quotes the wording, so you can check that the tool does what the standard actually says rather than what a blog post said it says.

All 7 tools