Secret Key Generator
Generate secret keys for JWT HS256/HS512, AES-128/256, Laravel APP_KEY, Rails secret_key_base, Django SECRET_KEY and session cookies with secure randomness.
256 bits of entropy · 43 characters per value
Generated locally with crypto.getRandomValues; nothing is sent or stored. Keep secrets in environment variables or a secret manager, never in source code.
What is Secret Key Generator?
Frameworks and libraries need random secret keys in a specific format: a 256-bit Base64url string for JWT HS256, 32 hex bytes for AES-256, base64: + 32 bytes for Laravel's APP_KEY, 128 hex characters for Rails' secret_key_base, 50 characters for Django's SECRET_KEY. Choose the Purpose and the tool generates a key with the right length and encoding, or customize the format yourself.
How to use Secret Key Generator
- Pick a Purpose such as JWT HS256 secret or Laravel APP_KEY.
- Adjust the Format and Random bytes / Length if needed (this switches to Custom).
- Click Regenerate until you have the key, then copy it into your environment variables.
Example
Purpose: JWT HS256 secret (256 bits, Base64url)
-IXerdjEBBrFmWvMzQ0izB3-w1aweuEukH9SlJBWmwE
256 bits of entropy. Random — your key will differ.
When to use Secret Key Generator
Use it when setting up a new environment, rotating a leaked key, or configuring JWT signing. For asymmetric signing (RS256, ES256) you need a key pair, not a shared secret. Never commit keys to Git; put them in environment variables or a secrets manager.
How Secret Key Generator works
All keys come from crypto.getRandomValues. Byte-based presets draw the exact number of bytes the algorithm needs (16 for AES-128, 32 for AES-256 and HS256, 64 for HS512 and Rails) and encode them as hex, Base64 or Base64url. Django's key is 50 characters chosen uniformly from letters and digits (about 298 bits). The entropy line shows the strength in bits and warns below 128 bits.
Common Use Cases
- Setting APP_KEY for a new Laravel deployment
- Creating a JWT HS256 signing secret
- Generating an AES-256 key for encrypting data at rest
- Rotating Django or Rails secrets after a leak
Security Note
Generated locally and never sent anywhere. Anyone with the key can forge tokens or decrypt data, so store it only in environment variables or a secrets manager.
FAQs
How long should a JWT HS256 secret be?
At least 256 bits (32 bytes), the size of the SHA-256 output, as recommended by RFC 7518. HS512 should use 512 bits.
Is this the same as running php artisan key:generate?
Yes in format: Laravel's command also creates 32 random bytes, Base64-encodes them and prefixes base64:.
What happens if I change the key of a running app?
Existing sessions, signed cookies, tokens and anything encrypted with the old key become invalid or unreadable. Plan rotations carefully.