Secret Generator
Cryptographically secure random value generation. Powered by Web Crypto API.
Configuration
Ideal for generic API Keys & Tokens
Configure options and generate.
Why Use a Cryptographic Secret Generator?
The quality of your secrets is the foundation of your application's security. A weak API key or password generated with a non-cryptographic random function is predictable and brute-forceable. This tool uses the browser's Web Crypto API (crypto.getRandomValues), the same entropy source used by operating systems for TLS key generation — making it suitable for production-grade secrets.
Every value generated here is created entirely in your browser. No network request is made and nothing is logged — your generated secrets are yours alone.
When to Use Each Mode
- Base64: API keys, OAuth client secrets, session tokens, HMAC signing keys, encryption keys. The standard choice for machine-to-machine authentication.
- UUID v4: Database primary keys, idempotency keys, file upload names, distributed system correlation IDs. Globally unique with no central coordination needed.
- Passphrase: Master passwords, recovery codes, passwords you need to remember or type. Multiple random words give high entropy with human readability.
- JWT Secret: HMAC-SHA256 JWT signing keys. Correctly sized and formatted for jsonwebtoken, PyJWT, and other standard JWT libraries.
- Custom: Passwords with specific character set requirements (e.g., systems that require uppercase, numbers, and symbols in a specific length range).
Frequently Asked Questions
What makes a secret cryptographically secure?
A secret is cryptographically secure when it is generated using a cryptographically secure pseudorandom number generator (CSPRNG). This tool uses the Web Crypto API's crypto.getRandomValues() function, which uses the operating system's entropy source (e.g., /dev/urandom on Linux/macOS, CryptGenRandom on Windows). This is fundamentally different from Math.random(), which is a deterministic algorithm unsuitable for security-sensitive values.
What is the difference between Base64, UUID, and passphrase modes?
Base64 mode generates a random byte sequence encoded in Base64 — ideal for API keys, session tokens, and symmetric encryption keys. UUID v4 generates a universally unique identifier in standard 8-4-4-4-12 format — the standard for database primary keys and idempotency keys. Passphrase mode generates multiple random words joined by hyphens — easy to remember and type while still having high entropy. JWT mode generates a Base64url-encoded secret sized for HMAC-SHA256 signing.
How much entropy do I need for an API key?
For modern security, aim for at least 128 bits of entropy. A 32-byte (256-bit) random value is the practical standard — this gives an attacker approximately 3.4 × 10^38 possible values to guess, making brute force computationally infeasible even for nation-state adversaries. The entropy meter in this tool shows bits of entropy and estimated crack time to help you choose the right length.
Is it safe to generate secrets in a browser?
Yes, when the tool uses the Web Crypto API (window.crypto.getRandomValues). The browser's CSPRNG is seeded by the OS entropy pool and is considered cryptographically secure. This tool is 100% client-side — generated values are never transmitted to any server. That said, browser extensions with broad permissions could theoretically intercept page state, so use a clean browser profile for highly sensitive values.
How do I use a generated secret as a JWT signing key?
Use JWT mode to generate a Base64url-encoded signing secret. In Node.js with the jsonwebtoken library: const jwt = require("jsonwebtoken"); const token = jwt.sign({ sub: userId }, process.env.JWT_SECRET, { expiresIn: "1h" }). Store the generated secret in your .env file as JWT_SECRET and never commit it to version control. Use the .env copy button in this tool to format it correctly for pasting into .env files.
What is UUID v4 used for?
UUID v4 (Universally Unique Identifier version 4) is a 128-bit value with 122 random bits (6 bits are version/variant). It is used as database primary keys when you need globally unique IDs without a central authority, as idempotency keys for payment APIs, as correlation IDs in distributed system logs, and as file upload names to prevent collisions. The probability of two UUIDs colliding is astronomically low (1 in 5.3 × 10^36).
Where should I store generated secrets?
Store secrets in a secrets manager or environment variables — never in source code, git history, or client-side JavaScript. For local development, use .env files (and add .env to .gitignore). For production, use your platform's secrets system: AWS Secrets Manager, Google Cloud Secret Manager, HashiCorp Vault, or Vercel/Railway environment variables. Rotate secrets regularly and audit access logs for sensitive keys.