Skip to content

Random Key Generator

Generates cryptographic random bytes as hex, Base64 or Base64URL at a chosen length, for app secrets.

A `SECRET_KEY` or a JWT signing key needs to be random bytes of a stated length in a stated encoding, and the usual improvisations — a mashed keyboard, a UUID, a hash of the project name — are all shorter on entropy than they look. This produces the bytes and encodes them.

🔒 Runs entirely in your browserrandomkeysecretgenerator

Random secret

LAak_RrjgHvWbfdo7ouTr4vX4-GWmOX0knEH7_PGWsM
As a JWK (oct)
{
  "kty": "oct",
  "k": "LAak_RrjgHvWbfdo7ouTr4vX4-GWmOX0knEH7_PGWsM",
  "ext": true
}

WebCrypto key

A real CryptoKey, exported as JWK — usable directly with crypto.subtle.

Every byte comes from crypto.getRandomValues and stays in this tab. Nothing is generated on, or sent to, a server.

How to use it

  1. Choose the length in bytes

    32 bytes (256 bits) covers almost everything — HMAC-SHA256, AES-256, session keys. Longer is not stronger for these; the algorithm defines the useful size.

  2. Pick the encoding the config wants

    Hex is unambiguous and twice as long. Base64URL avoids `+`, `/` and `=`, which is what you want in a URL, a header or a `.env` file that something else will parse.

  3. Put it in the secret store, not the repository

    A key committed once is a key that has to be rotated, however quickly the commit was reverted. Generate a different one per environment.

Common questions

Where does the randomness come from?

`crypto.getRandomValues`, the browser’s CSPRNG, seeded by the operating system. Nothing is transmitted and nothing is stored.

Is a key generated in a browser as good as one from `openssl rand`?

The randomness is the same quality — both draw from the OS. The difference is where the key is displayed: on a screen, possibly in a browser that syncs, possibly with an extension watching the DOM. On a machine you do not control, use the command line.

Can I use this for a UUID?

Use the UUID generator instead — a UUIDv4 has a fixed layout with six bits spent on version and variant, so a raw random string is not a valid one.

Feed it from

UUID Generator

Generates UUID v1, v4, v5 and v7 in bulk, and decodes the timestamp out of a v1 or v7 value.

Runs entirely in your browser

ULID & NanoID Generator

Generates sortable ULIDs or short NanoIDs with a chosen alphabet and length, and shows collision odds.

Runs entirely in your browser

HMAC Generator

Computes an HMAC over a message with a chosen hash and key encoding, for webhook signature checks.

Runs entirely in your browser

Text Encrypt & Decrypt

Encrypts a message with AES-GCM from a passphrase and produces a self-contained Base64 blob.

Runs entirely in your browser

Next

These accept what this tool produces, so the result can go straight in.

.env Parser & Converter

Parses a .env file and converts it to JSON, YAML, shell exports, Docker or Kubernetes formats.

Runs entirely in your browser

HMAC Generator

Computes an HMAC over a message with a chosen hash and key encoding, for webhook signature checks.

Runs entirely in your browser

Password Generator

Generates random passwords with length, character set and ambiguous-character rules, in bulk if needed.

Runs entirely in your browser

UUID Generator

Generates UUID v1, v4, v5 and v7 in bulk, and decodes the timestamp out of a v1 or v7 value.

Runs entirely in your browser

Suspicious URL Check

Inspects a link’s shape before you open it — lookalike characters, IP-literal hosts, @ tricks, deep subdomains, odd ports, shorteners — and on request traces its redirects and looks up the domain’s registration date. No reputation database.

Local, with an optional server assist

Base64 Encoder & Decoder

Encodes and decodes Base64 and Base64URL for text or files, handling UTF-8 correctly.

Runs entirely in your browser