How should API keys and secrets be generated and handled?
A secret is only as strong as its randomness: keys and tokens should come from a cryptographically secure generator with at least 128 bits of entropy (256 for HMAC keys), never from a password or a timestamp. RSA keys should be 2048 bits or more, kept in PEM files with restricted permissions. Secrets belong in a vault or environment configuration, rotated on a schedule, and never in source code, logs or URLs.
Security note: Anything generated here is only as private as where you paste it next. Generate keys locally, store them in a secrets manager, and rotate any key that was ever committed to a repository or shared in chat.
How to use Random Secret Generator
- Choose the number of random bytes (32 for JWT/session secrets).
- Pick a format and how many secrets you need.
- Optionally enter a variable name for .env output.
- Click Generate, then copy into your secret store.
Random Secret Generator features
- crypto.getRandomValues — cryptographically secure randomness
- Hex, Base64, Base64url, Base32, alphanumeric and printable-ASCII formats
- Choose the entropy in bytes (8–1024); generate up to 100 secrets at once
- .env style output (NAME=value)
- Warns when the entropy is below 128 bits
Random Secret Generator example
A 32-byte Base64url secret for JWT_SECRET
Input:
Bytes: 32 · Format: base64url · Variable: JWT_SECRETOutput:
JWT_SECRET=tUSHdvHM79Cpnv67LfUnANNIJ4nhrH6bKsv59X6k1UkFrequently asked questions about Random Secret Generator
How many bytes should a JWT HS256 secret have?
At least 32 bytes (256 bits). HS384 needs 48 and HS512 needs 64 bytes. Longer is fine; the tool defaults to 32.
Which format should I choose?
Hex is safest to paste anywhere. Base64 is shorter. Base64url is safe in URLs and JWT keys. Use "alphanumeric" or "printable ASCII" when a system forbids certain characters — the length is adjusted to keep the requested entropy.
Is the randomness really secure?
Yes. Values come from crypto.getRandomValues, the browser's cryptographically secure generator backed by the operating system — the same source used by WebCrypto key generation.
Does anyone else see the secret?
No. It is generated in your browser and never transmitted or stored. Reload or click Regenerate to get a new one.
Technical notes
Each byte comes directly from the browser's CSPRNG. For alphabets whose size is not a power of two (alphanumeric, ASCII) the tool picks characters with unbiased random indices and increases the length so the result carries at least the requested number of bits.
References
- RFC 4086: Randomness Requirements for SecurityWhy secrets, keys and tokens need cryptographically strong randomness and how much entropy is enough.
- NIST SP 800-57 Part 1 Rev. 5: Recommendation for Key ManagementKey sizes, algorithm strengths and key lifetimes — why 2048-bit RSA and 256-bit symmetric keys are today's baseline.
- OWASP Cheat Sheet Series: Secrets ManagementHow API keys and secrets should be generated, stored, rotated and kept out of code and logs.