Secret Key Generator for API Keys and JWT Secrets

What the secret key generator is for

Applications are full of values that must simply be unguessable: the HMAC secret that signs your JWTs, a session or cookie signing key, a webhook signing secret, Django's SECRET_KEY, Rails' secret_key_base, an encryption key for a field-level cipher, or the API keys you issue to your own customers. All of them are just random bytes, and the only property that matters is that they come from a cryptographically secure random number generator and are long enough.

This tool draws bytes from crypto.getRandomValues, the browser's CSPRNG, which is seeded by the operating system — the same source as /dev/urandom or Python's secrets module. Keys are generated locally and never sent anywhere, and the page deliberately has no share link because the output is a secret.

Choosing a length and a format

Length is measured in random bytes, and every byte is 8 bits of entropy. 16 bytes (128 bits) is the floor for anything security-relevant and is already far beyond brute force. 32 bytes (256 bits) is the sensible default and matches the key size of HS256 — RFC 7518 requires an HMAC key at least as long as the hash output, so 32 bytes for HS256, 48 for HS384 and 64 for HS512. Use 64 bytes when a framework asks for it or for HS512.

The format only changes how the bytes are written down, not how strong they are. Hex uses two characters per byte and is safe in any config file or shell. Base64 is about a third shorter but contains +, / and =, which need escaping in URLs. Base64url swaps those for - and _ and drops the padding, so it is safe in URLs, HTTP headers and file names. Alphanumeric uses only A–Z, a–z and 0–9 for systems that reject symbols; it is built by rejection sampling — random bytes outside an exact multiple of 62 are discarded — so every character is equally likely, and its length is chosen to carry at least the same entropy as the selected byte count (43 characters for 256 bits). Django SECRET_KEY produces 50 characters from the same alphabet Django's get_random_secret_key() uses, roughly 282 bits.

The entropy shown is the exact number of random bits in each key. A prefix adds none.

Prefixes, bulk keys and handling secrets

A short prefix such as sk_live_ or myapp_test_ makes keys self-describing: you can tell environment and purpose at a glance, route support tickets, and let secret scanners such as GitHub's push protection recognise leaked keys by pattern. Bulk mode generates up to 100 independent keys at once, for seeding test fixtures or issuing a batch of tokens.

Once generated, store secrets in environment variables or a secrets manager rather than in source code, rotate them when people leave or a leak is suspected, and store only a hash of customer API keys server-side, as you would a password. For anything a human must type or remember, use a password generator instead; for identifiers that only need to be unique rather than secret, a UUID is enough.