Secret Key Generator

Generate signing keys and encryption secrets of the right length.

Key type

Encoding

Prefix (optional)

Makes leaked keys identifiable to secret scanners.

How many1

What does Secret Key Generator do?

Produce secrets sized correctly for their purpose — JWT signing keys, AES-128 and AES-256 keys, HMAC secrets and framework session keys — with the required length enforced rather than left to guesswork.

How to Use Secret Key Generator

1
Choose the key typeThe required length is set automatically.
2
Pick an encodingMatch what your library expects.
3
Copy the keyOr the ready-made .env line.
4
Store it securelyIn a secret manager, never in version control.

Key Features

Presets for JWT HS256/HS384/HS512, AES-128, AES-192, AES-256 and HMAC
Correct length enforced for the algorithm you select
Hex, Base64 and Base64URL output
Ready-formatted .env line for the key
Explains what each key type is for and how often to rotate it

Frequently Asked Questions

How long should a JWT signing secret be?

At least as long as the hash output: 32 bytes for HS256, 48 for HS384, 64 for HS512. A shorter secret weakens HMAC, and a short human-chosen phrase can be brute-forced offline from a single captured token.

Where should I store a secret key?

In a dedicated secret manager, or in environment variables injected at deploy time. Never in source control — even a deleted commit stays in the git history and in every clone.

How often should I rotate keys?

Immediately on any suspected exposure, on staff changes with access, and otherwise on a schedule that fits your risk — annually is common. Design for rotation from the start by supporting two valid keys during a changeover.

Is AES-256 meaningfully better than AES-128?

Not against classical attacks — AES-128 is already unbreakable by brute force. AES-256 offers a larger margin against future cryptanalysis and post-quantum considerations, at a small performance cost. Both are sound choices.

Runs in your browser

This tool works with your network connection switched off. Values are produced by the browser Web Crypto API and never leave your device — no request is made, nothing is logged.

How the rest of the site handles data