This secret key generator produces raw cryptographic key material in your browser, from 128 to 512 bits, in hex, Base64 or Base64URL. Nothing is transmitted, and it keeps working with the network disconnected.
What is a secret key?
A secret key is a block of random bytes used to encrypt data or compute signatures. Unlike a password it is never typed by a person, and unlike an API key it is never transmitted — it stays on the server that uses it.
Secret key vs API key vs JWT secret vs salt
These four values all look like the same thing: a long run of meaningless characters. They behave nothing alike, and only one of them belongs in a secret key generator.
A comparison of four kinds of random value. An API key is transmitted with every request, is secret, and is measured in characters. A secret key is never transmitted, is secret, and is measured in bits. A JWT secret is never transmitted, is secret, and its length is set by the signing algorithm. A salt is stored alongside the hash, is not secret at all, and is measured in bits. The salt is the outlier: it is the only one that is public by design.
An API key travels with every request, so it is measured in characters and shaped for transport. A secret key never moves, so it is measured in bits.
A JWT secret is a secret key with its length dictated by the signing algorithm. A salt is not secret at all: it is stored beside the hash it protects.
Why secret keys are measured in bits
Ciphers consume bytes, not text. AES-256 needs exactly 32 bytes, and has no notion of how a secret key generator chose to print them.
That is why this secret key generator asks for a bit length first and an encoding second. The bits are the key. The encoding is just how you write it down.
How many characters is a 256-bit key?
This is the question that brings most people to a secret key generator, and the answer is that it depends entirely on the encoding.
Bits, bytes, and characters
Divide the bits by eight to get bytes: 256 bits is 32 bytes. How many characters a secret key generator needs to print them depends on how many bits each character carries.
The same 32 bytes of key material shown as hexadecimal, Base64 and Base64URL. Hex takes 64 characters, Base64 takes 44 including padding, and Base64URL takes 43. All three encode identical key material and are equally strong; only the printed length differs.
Hex
Each hex character carries 4 bits, so every byte takes two characters. A 256-bit key becomes 64 characters.
Hex is verbose but unambiguous, which makes it the easiest encoding to read in a log or compare by eye. That is why this secret key generator defaults to it.
Base64 and Base64URL
Base64 packs 6 bits per character, so 32 bytes fit into 44 characters including padding. Base64URL uses the same packing without padding and swaps two characters for URL-safe ones, giving 43.
| Key size | Bytes | Hex | Base64 | Base64URL |
|---|---|---|---|---|
| 128 bits | 16 | 32 | 24 | 22 |
| 192 bits | 24 | 48 | 32 | 32 |
| 256 bits | 32 | 64 | 44 | 43 |
| 384 bits | 48 | 96 | 64 | 64 |
| 512 bits | 64 | 128 | 88 | 86 |
Why the encoding does not change the strength
A 43-character Base64URL key is not weaker than a 64-character hex key. Whatever encoding a secret key generator prints, the same 32 bytes are underneath.
Judging key strength by how long the string looks is the most common mistake here. Count the bits, never the characters.
Choosing a key length
128 bits
Still beyond brute force, and the right choice when a specification asks for it — AES-128, for instance. Nothing about 128 bits is broken, so a secret key generator offering it is not cutting corners.
256 bits — the default
The standard choice for encryption keys, HMAC keys and session secrets. It costs nothing extra and matches what most libraries expect, which is why this secret key generator opens on it.
384 and 512 bits
Reach for these when an algorithm demands them. HS384 and HS512 are the common cases, since a signing key shorter than the hash output weakens the construction.
When a longer key does nothing for you
Beyond 256 bits, extra length buys no protection against brute force. Searching a 256-bit keyspace is not a hardware problem; it is a physics one.
If a system is compromised, it will be through a leaked key, a flawed protocol, or a bug — never because 256 bits was not enough.
How to use this secret key generator
Pick a length
Start at 256 bits unless a specification tells you otherwise. The readout shows the bits, the byte count and the resulting character count together, which is the part most secret key generator tools leave out.
Pick an encoding
Match whatever your library expects. If you have no constraint, hex is easiest to debug and Base64URL is most compact; the secret key generator produces identical key material either way.
Generate in bulk
Run the secret key generator in bulk, up to 50 at a time, when you need a distinct key per environment or per tenant, then download the list as a text file.
Storing and rotating secret keys
Never in source control
Keys belong in environment variables or a secret manager. A key committed once stays in the git history long after the file is deleted.
One key, one purpose
Run the secret key generator once per purpose: encryption, signing and session state each get their own. Reusing one key across purposes means a single leak compromises all of them.
Rotating without downtime
Rotation needs a window where both the old and new key are accepted. Build that in early; retrofitting it during an incident is how outages happen.
What a leaked key costs you
A leaked encryption key exposes everything it ever encrypted, including data captured months ago. Unlike a password, rotating it does not protect what has already been taken.
That asymmetry is why secret keys get stricter handling than credentials that can simply be revoked.
Frequently asked questions
How many characters is a 256-bit key?
That depends on the encoding, not on the strength. 256 bits is 32 bytes, which prints as 64 characters in hex, 43 in Base64URL, or 44 in Base64 with padding. All three are the same key.
Is a longer key always better?
No. Above 256 bits you gain nothing against brute force, because no attacker can search a 256-bit space regardless of hardware. Longer keys matter only when an algorithm requires them, as HS512 does.
What is the difference between a secret key and an API key?
An API key is sent with every request to identify the caller. A secret key never leaves your server and is used to encrypt data or compute signatures. If a value is transmitted, it is a credential rather than a secret key.
Which encoding should I use?
Hex is easiest to read and debug but doubles the length. Base64URL is the most compact and is safe in URLs and filenames. Pick whichever your library expects, since every option in this secret key generator carries identical key material.
Can I use a secret key as a password?
You can, but it is the wrong shape. A 256-bit hex key is 64 characters of hex digits, which is unpleasant to type and no stronger than a much shorter random password. Use the password generator for anything a person has to handle.
Are the keys generated on your server?
No. They come from the Web Crypto API in your browser and are never transmitted. You can verify it in your browser’s network panel, or by disconnecting from the internet and generating again.
How often should I rotate a secret key?
On a schedule you can actually keep, and immediately if you suspect exposure. Rotation only works if your system can accept two valid keys at once, so build that in before you need it.
Can I use this key for AES encryption?
Yes, provided the length matches what your implementation expects: AES-128 needs 128 bits and AES-256 needs 256. This secret key generator produces the raw random bytes; your crypto library does the rest.
More free generators
Every generator here runs locally in your browser, with no account and no limits. For a value with a specific character shape rather than a bit length, use the random string generator.
Password Tools
Random Generators
Keys & Secrets
Methodology
Last updated
How the character counts are calculated
hex: bytes × 2 · base64: ⌈bytes ÷ 3⌉ × 4 · base64url: ⌈bytes × 4 ÷ 3⌉
The table above is not hand-written. Every figure comes from the same function the generator uses, and the test suite asserts each one against the length of a real generated key, so the published numbers cannot drift from the tool's behaviour.
Why no entropy estimate is shown
Elsewhere on this site the entropy readout is a calculation. Here it would be a tautology: a 256-bit key has 256 bits of entropy by definition, because every bit comes directly fromcrypto.getRandomValues(). The readout shows the bits-to-characters relationship instead, which is the part people actually need.
What this tool does not do
It produces raw symmetric key material and nothing else. It does not choose an algorithm, generate asymmetric key pairs, emit PEM or DER containers, or produce initialisation vectors. Tools that offer Blowfish or 3DES alongside AES are presenting long-superseded algorithms as equivalent choices; this one stays out of that decision entirely.