Utilities Center

Hash-based Secret Key Generator

Generate random API keys & secret tokens

Create cryptographically random secret keys and tokens as hex or Base64 strings of any length, using the Web Crypto API — entirely in your browser.

Secret key · 64 chars
fd4ff380e352c43f7d82228b18a5732b0dbe6502df8844b0416ffa4797001988

About the hash-based secret key generator

A secret key is a high-entropy random string used to sign requests (HMAC), encrypt data, or authenticate API calls. The strength of a key comes entirely from its randomness and length — longer keys resist brute-force attacks exponentially better than shorter ones.

This generator uses the native crypto.getRandomValues CSPRNG, so every byte is cryptographically random and suitable for production secrets. Pick a key length in bits (128, 256 or 512), choose hex or Base64 output, and optionally prefix the key (for example sk_live_) to match your application's format.

Common uses

  • API keys — bearer tokens for REST APIs.
  • HMAC signing secrets — for webhook signature verification.
  • Encryption keys — random keys for AES-GCM or similar.
  • Session tokens — unguessable session identifiers.

How to use the hash-based secret key generator

  1. Choose a key length

    Pick 128, 256 or 512 bits — 256 bits is a strong default for most applications.

  2. Pick an encoding

    Hex produces a longer alphanumeric string; Base64 is more compact.

  3. Add a prefix (optional)

    Prepend a label like sk_ to match your app's key format.

  4. Generate & copy

    Click Generate for a fresh key, then copy it to your clipboard.

Frequently asked questions

Are these keys cryptographically secure?
Yes. They are generated with crypto.getRandomValues, a cryptographically secure pseudo-random number generator provided by the browser, suitable for production secrets.
How long should my secret key be?
256 bits (32 bytes) is a strong default for HMAC and API keys. Use 512 bits for extra-sensitive encryption keys. Avoid 128 bits for new security-critical systems.
Is my generated key sent anywhere?
No. The key is generated entirely in your browser and never transmitted to a server.
What is the difference between hex and Base64?
Hex encodes each byte as two characters (0-9, a-f), producing a longer but simpler string. Base64 encodes three bytes as four characters, producing a more compact string.
Can I add a prefix like sk_live_?
Yes. Enter any prefix in the prefix field and it will be prepended to every generated key. The prefix itself is not random.

I want to…

Common reasons people reach for the hash-based secret key generator — see if it matches your task.

  • Generate a random API key
  • Create a secure secret token
  • Produce a hex or Base64 encryption key
  • Generate an HMAC signing secret

Related free tools

More free online utilities that pair well with this one — same-category tools for the same task, plus handy extras from other categories.