Secure Key Generator

About this tool

A secure key generator produces high-entropy random values suitable for real security work: API keys, encryption keys, session tokens, signing secrets, and other credentials that must be impossible to guess. You choose the length in bytes and whether to encode the result as hexadecimal or base64, and can generate up to a hundred keys in one batch.

The keys are filled with random bytes from the browser's Web Crypto API (crypto.getRandomValues), a cryptographically secure random source, rather than the ordinary Math.random. A key of N bytes carries N x 8 bits of entropy, so a 32-byte key gives 256 bits — the tool shows the exact entropy as you adjust the length, and offers common presets of 16, 24, 32, 48, and 64 bytes.

Every key is generated locally in your browser and is never transmitted, logged, or stored on a server, so even sensitive secrets stay on your device. Because these values are meant to be secret, treat them accordingly: store them in a secrets manager or environment variable and never commit them to source control.

How to generate a secure key

1. Set the key length in bytes, or pick one of the presets such as 32 bytes.
2. Choose the output format — hexadecimal or the more compact base64.
3. Set how many keys you need, up to one hundred at once.
4. Click Generate and review the entropy shown for your chosen length.
5. Copy an individual key or copy them all, then store them somewhere secure.

Frequently asked questions

Are these keys cryptographically secure?

Yes. Each key is filled with random bytes from the browser's Web Crypto API (crypto.getRandomValues), a cryptographically secure random source suitable for encryption keys, API keys, and other secrets.

What key length should I use?

16 bytes (128 bits) is fine for most session tokens, while 32 bytes (256 bits) is a common standard for API and encryption keys. Longer keys add more entropy at the cost of a longer string.

What is the difference between hex and base64 output?

Both encode the same random bytes. Hexadecimal is twice the byte length and uses only 0-9 and a-f, while base64 is more compact but uses a wider character set.

Is it safe to generate secrets in the browser?

Yes. Keys are generated locally with the Web Crypto API and are never transmitted or stored on a server, so they stay on your device. Still store the generated secrets securely and never commit them to source control.

How much entropy does a key have?

A key of N bytes carries N x 8 bits of entropy, so a 32-byte key has 256 bits. The tool displays the exact entropy in bits as you change the length.