Utilities Center

Guide

How to Generate Secure Secret Keys and API Tokens

Learn what makes a good secret key, how to generate one safely, and how to store it without leaking it.

Open the Hash-based Secret Key Generator

A secret key generator produces cryptographically random bytes and renders them as hex or Base64 strings for use as API keys, tokens, or signing secrets. Strong secrets are the foundation of secure authentication and integrations.

What makes a good secret key

A good secret is long (32 bytes / 256 bits minimum for signing), generated by a cryptographic random source, and never reused across services. Hex doubles the length (64 chars for 32 bytes); Base64 is shorter (44 chars) but may need URL-safe encoding.

Hex vs. Base64

Hex encodes each byte as two characters (0-9a-f), so it is case-insensitive and easy to paste into config. Base64 encodes 3 bytes as 4 characters, so it is more compact but uses +, /, and = which can need URL-safe handling. Pick the format your consuming system expects.

How to generate a secret safely

  1. Choose a length in bytes (32 is a good default).
  2. Choose hex or Base64 output.
  3. Generate using a cryptographic random source (the tool uses the Web Crypto API).
  4. Copy the secret directly into a secure secret store — never into code.

Examples

A 32-byte hex secret looks like "a3f5...94c2" (64 chars) and works as an HMAC signing key. A 32-byte Base64 secret is about 44 chars and works as a JWT signing key. Both have 256 bits of entropy — infeasible to guess.

Storing secrets safely

  • Store secrets in a dedicated secret manager or environment variables, not in source code.
  • Never commit secrets to git or log them.
  • Rotate secrets if they may have leaked.
  • Give each service its own secret; do not share.

Put it into practice

Use the Hash-based Secret Key Generator right now — free, in your browser, no sign-up required.

Try the Hash-based Secret Key Generator

More guides

Back to all tools

Related free tools

More free online utilities that pair well with this one — same-category tools for the same task, plus handy extras from other categories.