Need a signing secret for a JWT or a session cookie? The Secret Key Generator makes random key material in your browser. You pick an app preset and an encoding, then copy the result.
This tool suits backend developers and DevOps engineers setting up auth. It creates 32 or 64 random bytes and shows them as hex or Base64 text.
Table of Contents
- What the Tool Does
- How to Use the Secret Key Generator
- How the Secret Is Built
- Worked Example
- How to Read the Results
- Presets, Encodings, and Length
- Limitations and Assumptions
- FAQs About the Secret Key Generator
What the Tool Does
The generator makes one random secret from a preset and an encoding. Two dropdowns set the options, and one button runs it.
- Application Preset: picks the byte length, either 32 or 64 bytes.
- Encoding Format: shows the bytes as hex, Base64, or Base64URL.
- Generate Secret Key makes a fresh secret each time you press it.
- Toggle Visibility hides or shows the value, which starts masked.
- Copy Secret copies the full secret to your clipboard.
Three cards show the preset name, the bit strength, and the encoding. The secret sits in a masked field until you reveal it.
How to Use the Secret Key Generator
- Pick an Application Preset, such as JWT HS256 or AES-256 key material.
- Pick an Encoding Format: Hexadecimal, Base64, or Base64URL.
- Press Generate Secret Key to make the value.
- Press Toggle Visibility to read the masked field.
- Press Copy Secret to place the key on your clipboard.
Changing a preset regenerates the key right away. Changing the encoding re-shows the same bytes in the new format at once.
How the Secret Is Built
The tool draws random bytes, then turns them into text. The preset sets the byte count, and the encoding sets the display form.
Preset (32 or 64 bytes)→Encoding=Secret Key
- JWT HS512 uses 64 bytes. Every other preset uses 32 bytes.
- Bit strength = bytes times 8. So 32 bytes is 256 bits.
- Random bytes come from window.crypto.getRandomValues, a secure source.
- Hex shows two characters per byte. Base64URL swaps + and / and drops padding.
The secret is raw random material. The preset name is a label, so the bytes fit JWT, HMAC, session, or AES-256 use.
Worked Example
Marcus needs a JWT HS256 secret in hex. He keeps the default preset and picks Hexadecimal, then presses Generate.
A 32-byte secret in hex is always 64 characters long. Here is how each encoding changes the length for the same 32 bytes.
| Encoding | 32 bytes (256-bit) | 64 bytes (512-bit) |
|---|
| Hexadecimal | 64 chars | 128 chars |
| Base64 | 44 chars | 88 chars |
| Base64URL | 43 chars | 86 chars |
The characters change on every run, but the length stays fixed for each pairing. Base64 is shorter than hex because it packs more data per character.
How to Read the Results
Preset shows the chosen profile, such as JWT 256-bit or AES-256 Key Material. Entropy Rating shows the bit strength, like 256 bits.
Encoding names the output form in capitals. The output field holds the secret itself, masked until you toggle it on.
Presets, Encodings, and Length
All five presets make strong key material. Four use 32 bytes, and only JWT HS512 uses 64. The names simply hint at a common use.
Encoding does not change the strength. Hex, Base64, and Base64URL all carry the same random bytes. Base64URL is safe for URLs and file names because it avoids + and /.
A 256-bit secret is strong enough for signing and most symmetric keys. For a bulk list of tokens, use the secure token generator. For keys with a readable prefix, try the API key generator.
Remember that this tool does not hash or encrypt anything. To hash a password for storage, use the bcrypt hash generator. To decode a Base64 value, open the Base64 decoder. More utilities sit in the developer tools hub.
Limitations and Assumptions
- You cannot type a custom byte length. Only the preset choices of 32 or 64 bytes are offered.
- The tool makes one secret per run. There is no quantity or batch option.
- It does not perform encryption or RSA key pairs. It outputs random symmetric key material only.
- The output starts masked as a password field. Toggle visibility before you copy by hand.
- Copy Secret shows a short Copied or Copy blocked note. If it is blocked, reveal the value and copy by hand.
- Store the secret safely. Anyone who sees it can sign or decrypt as if they were your server.
FAQs About the Secret Key Generator
Is the Secret Key Generator secure?
The bytes come from window.crypto.getRandomValues, a cryptographically secure source. The secret is made in your browser and never sent to a server. Keep the copied value private.
What is the difference between the presets?
The preset sets the byte count and a label. JWT HS512 uses 64 bytes, giving 512 bits. The other four use 32 bytes, giving 256 bits. All produce random key material.
Does the encoding change how strong the key is?
No. Hex, Base64, and Base64URL all hold the same random bytes. They differ only in length and allowed characters. The bit strength depends on the byte count, not the encoding.
Can I use this to encrypt data?
Not directly. The tool makes a random key, not a cipher. You feed the key into your own library, such as an HMAC or AES function. The generator never encrypts your data.
Why is the key hidden at first?
The output field starts as a masked password box to avoid shoulder surfing. Press Toggle Visibility to read it. Copy Secret works even while the value stays hidden.
Should I reuse one secret across apps?
No. Generate a separate secret for each app and environment. Reusing one secret means a single leak affects every system that shares it. Unique keys limit the blast radius.
This calculator gives general estimates only and is not professional advice. Reviewed for general accuracy by Prof. Dr. Khalil Mudassar, PhD.