How to generate a random secret key

By

Generate a random secret for an HMAC or an API token. Pick the byte length, then copy hex, Base64, or Base64url. The key stays in the browser.

Free toolThis tutorial uses the Secret Key Generator. It runs in your browser, so open it in another tab and follow along.

A secret key is random bytes. The secret key generator draws them with crypto.getRandomValues and shows hex, Base64, or Base64url. The key is not stored in the URL. The URL only keeps the length and the encoding.

Changing the encoding rewrites the same bytes. Changing the length draws new bytes. Generate draws a new key at the current length.

Check the encoding on published bytes

The sample is not a secret. The bytes are 0 through 15, so you can check the encoding by hand.

  1. Open the secret key generator.
  2. Click Load sample bytes.
  3. Read the hex. Switch the encoding to Base64, then Base64url. Copy writes the current encoding.

Hex is 000102030405060708090a0b0c0d0e0f.

Base64 is AAECAwQFBgcICQoLDA0ODw==.

Base64url is AAECAwQFBgcICQoLDA0ODw.

The hex notes are:

This key is 16 bytes, 128 bits.

RFC 7518 section 3.2 says an HMAC key must be at least as long as the hash output. HS256 is 256 bits, which is 32 bytes. This key is shorter.

The OpenSSL line for hex is openssl rand -hex 16.

The Node line is:

node -e "process.stdout.write(require('node:crypto').randomBytes(16).toString('hex'))"

Base64 uses openssl rand -base64 16. The Node line is:

node -e "process.stdout.write(require('node:crypto').randomBytes(16).toString('base64'))"

Base64url adds one more note: OpenSSL has no base64url flag. The Node line uses base64url, and the padding is stripped.

The Node line is:

node -e "process.stdout.write(require('node:crypto').randomBytes(16).toString('base64url'))"

Base64url follows RFC 4648 section 5. Plus becomes a hyphen, slash becomes an underscore, and the = padding is removed. Node’s base64url is unpadded, so these 16 bytes match.

Use 32 bytes for HS256

RFC 7518 section 3.2 says an HMAC key must be at least as long as the hash output. HS256 is 256 bits, which is 32 bytes.

Pick 32 in the bytes menu and click Generate. The length note is: This key is 32 bytes, 256 bits.

The HMAC note, without the shorter sentence, is: RFC 7518 section 3.2 says an HMAC key must be at least as long as the hash output. HS256 is 256 bits, which is 32 bytes.

The OpenSSL line is openssl rand -hex 32. The Node line is:

node -e "process.stdout.write(require('node:crypto').randomBytes(32).toString('hex'))"

16, 24, 48, and 64 are the other lengths. A shorter key is still random. It is just under that HMAC length. This page does not estimate how long a guess would take.

Do not paste the sample bytes into a real config. They are published on this page.

A password you can type belongs in the password generator. This page is for a value a program stores.

How this page builds a secret keycrypto.getRandomValues fills the chosen number of bytes. The same bytes are then shown as hex, Base64, or Base64url. The key is not written to the URL.Pick a lengthcrypto.getRandomValuesEncodingHexBase64Base64url

How JWT signing actually works builds an HS256 signature with the Web Crypto API. JSON Web Token (JWT) explained is the format around that signature. How to protect secrets when coding agents deploy your app is about where a generated key should live after you copy it.

JWT signer signs a token once you have a key. Hash generator hashes a value. It does not draw a new key.

Try the Secret Key Generator

Generate a random secret key in the browser with the Web Crypto API. Pick 16 to 64 bytes and copy hex, Base64, or Base64url. The key is never stored in the URL.

Open the Secret Key Generator →

  • JWT Generator & Signer: Build and sign HS256 JWTs with Web Crypto, or verify a token against a secret. Secrets never leave your browser.
  • Password Generator: Passwords, passphrases, PINs, and random bytes via crypto.getRandomValues — with entropy bits and time-to-crack estimates.
  • Hash Generator: SHA-1/256/384/512 and MD5 digests plus HMAC signing, from text or files — hex or Base64, all in your browser.

More tool tutorials →

Want me to talk about your product? You can sponsor this site.