Free tool
Secret key generator
Random keys for apps and .env files: hex, base64, UUIDs, and the formats Django, Rails and Auth.js expect. Made in your browser; nothing is sent.
256 bits, the minimum RFC 7518 sets for HS256. Use it as the signing secret string, or decode the base64url to 32 raw bytes if your library takes bytes.
Values with symbols are single-quoted so $ and # survive dotenv and the shell.
Formats
The right key for the framework
- JWT HS256 secret
- 32 random bytes as base64url, 256 bits. HMAC-signed tokens are only as strong as this secret.
- Django SECRET_KEY
- 50 characters from the alphabet Django's own get_random_secret_key() uses. It signs sessions, password-reset links and messages.
- Rails secret_key_base
- 64 random bytes as 128 hex characters, the same shape bin/rails secret prints. Rails derives its cookie and message keys from it.
- Auth.js AUTH_SECRET
- 32 random bytes as base64, the same shape as openssl rand -base64 32. Auth.js uses it to encrypt session tokens.
- API keys
- A prefix you choose plus 32 characters from A–Z, a–z and 0–9, about 190 bits, with the SHA-256 to store instead of the key.
- Random bytes and UUIDs
- 16 to 128 bytes in hex, base64 or base64url for anything else, and version 4 UUIDs for identifiers.
Length
How long a secret key should be
Length in bits is what matters, not length in characters. 128 random bits is already out of reach of any brute-force attack; 256 bits is the usual choice because it leaves a wide margin and matches common hash sizes. For HMAC-signed JWTs it isn't a choice: RFC 7518 requires a key at least as long as the hash, so 32 bytes for HS256, 48 for HS384 and 64 for HS512.
The encoding changes how many characters those bits take. 32 bytes are 64 characters in hex, 44 in base64 and 43 in base64url. What never works is a key a person made up: supersecret2024 has the length of a key and the strength of a guess, and an HS256 secret like that can be cracked offline from a single token. The JWT decoder can show you which algorithm a token uses.
Handling
Keep it secret after you make it
- Put it in an environment variable or your platform's secret store. Add .env to .gitignore before the first commit, not after.
- Use a different key for development, staging and production, so a leaked laptop doesn't mean a leaked production.
- Rotating a key signs everyone out or invalidates what it signed, so plan for it, and rotate at once if a key lands in a repo, a ticket or a chat.
- Hand it over with something that forgets it. A message in Slack or email stays searchable for years; an EnvShare link is encrypted in your browser and deleted after the reads you allow.
Privacy
Generated in your browser
The key comes from crypto.getRandomValues, the browser's interface to the operating system's secure random generator. Characters from an alphabet are picked with rejection sampling, so none is more likely than another. Nothing is sent to our server: there is no request to make, the page keeps no history, and it works with the network off once loaded. The code is open source under the MIT license.
FAQ
Questions
Are these keys random enough for production?
Yes. Every byte comes from crypto.getRandomValues, the browser's interface to the operating system's cryptographically secure random generator, the same kind of source command-line tools like openssl rand use. Characters picked from an alphabet use rejection sampling, so each one is equally likely.
Is it safe to generate a secret on a website?
On this page the key is made in your tab and never sent or stored: there's no request to watch for, and the code is open source. If your policy says keys must be made locally anyway, the Strength panel shows the command-line equivalent for each format.
How long should a JWT secret be?
For HS256, at least 256 bits (32 random bytes): RFC 7518 requires a key at least as long as the hash output. Use 48 bytes for HS384 and 64 for HS512. Short or human-chosen secrets can be guessed offline from a single token.
What's the difference between hex, base64 and base64url?
They're three ways to write the same bytes as text. Hex uses 0–9 and a–f, two characters per byte. Base64 is about a third shorter but uses + / and =. Base64url swaps + and / for - and _ and drops the padding, so it's safe in URLs, headers and file names.
Is a UUID a secret?
A version 4 UUID from this page has 122 random bits, which is unguessable. But UUIDs are designed as identifiers and tend to end up in URLs, logs and analytics. Use one of the key formats for anything that grants access.
Why does the Django key contain symbols?
It uses Django's own alphabet from get_random_secret_key(): lowercase letters, digits and !@#$%^&*(-_=+). Fifty characters give about 282 bits. The .env line wraps it in single quotes so the $ and # survive dotenv parsers and the shell.
How should I store an API key?
Show the full key to its owner once, then store only a hash of it, such as the SHA-256 this page shows. When a request arrives, hash the key it carries and compare. A fixed prefix makes your keys recognizable in logs and to secret scanners.