Random Key Generator
Choose a format and a size to make random keys for API secrets, signing keys and tokens, with the strength in bits shown.
Worked examples
A signing secret
Format hex, 32 bytes, prefix whsec_
whsec_ followed by 64 hex characters, 256 bits of randomness
A different value is made every time.
About Random Key Generator
API secrets, signing keys, session tokens and encryption keys all need to be random in a way nobody can predict. A key made from a word, a date or the output of a simple random function can be guessed or recreated, and then every protection built on it fails. This generator takes its randomness from the browser's built-in source of strong randomness, the same one used for encryption, and turns it into keys in the form you need.
Choose hex for the most common form, Base64 for a shorter one, a version of Base64 that can sit inside a web address, Base32 for easy reading, or plain letters and numbers where symbols cause trouble. Pick the size from 16 to 64 bytes, or a number of characters for the letters and numbers form, make several at once and add a prefix if you want keys to be recognisable. The strength in bits is shown, and letters and numbers are picked without bias so that every character is equally likely.
How to use Random Key Generator
- Choose the format and the size. 32 bytes is a good default for signing keys.
- Set how many keys you want and an optional prefix.
- Press Make new keys any time you want a fresh set.
- Copy the keys and store them in your hosting settings or a password manager.
Common uses
- Making a signing secret for tokens or webhooks
- Creating API keys for customers or partners
- Generating a random value for session identifiers
- Making a key for an encryption library or a config file
Frequently asked questions
How many bits do I need?
128 bits is already far beyond what anyone can guess by trying every possibility. Use 256 bits for signing keys and long lived secrets, because it gives a wide margin for future advances.
Is a password the same as a key?
No. A password is made to be remembered, so it is shorter and less random. A key is made for a program to use, so it is long and fully random. Do not use a password where a key is needed.
Does the prefix weaken the key?
No. The prefix is just a label added to the front, and the random part is unchanged. The label helps scanning tools and people spot a key that has leaked into a log or a code repository.
Where should I keep a key?
In your hosting provider's settings for secrets, or in a password manager. Never in your source code, in a chat or in a screenshot. Make a new key if you think one has been seen by someone it should not have.
Are the keys stored or sent anywhere?
No. They are made on this page when you ask, and a new set is made when you press the button or change the size, format or count.