About this tool
Encryption keys, API secrets and bearer tokens all need the same thing underneath: a run of bytes nobody could have guessed. `Math.random()` is not built for this — it is a fast, predictable PRNG meant for animations and shuffles, not security. This tool instead calls `crypto.getRandomValues()`, the Web Crypto API's cryptographically secure random number generator, so the bytes you get are suitable for real key material: AES keys, HMAC secrets, session tokens, or anything else that needs to resist guessing.
Pick a bit length — 128 and 256 are the common AES key sizes, 512 and 1024 suit larger HMAC secrets or high-entropy tokens — then choose an encoding. Hex is the most universal (two characters per byte, easy to eyeball), Base64 is compact and widely supported, and Base64URL swaps out the `+`, `/` and `=` characters so the result drops safely into a URL, filename, or JWT without escaping. The separate API-key section below builds a Stripe-style secret — a short prefix, an underscore, then a random Base64URL string — the format used by countless SaaS APIs for their bearer tokens.
Everything happens in your browser: no key or token generated here is ever sent anywhere. That also means nothing is logged or recoverable if you navigate away, so copy your key before you leave the page.
Frequently asked questions
How many bits do I need for an AES key?
AES supports 128, 192 or 256-bit keys. AES-256 (using this tool's 256-bit hex or base64 output) is the most common modern choice and is considered secure well beyond any foreseeable future, including against theoretical quantum-computing attacks that would only roughly halve its effective strength.
Is base64url the same as regular base64?
No, they're close but not identical: base64url replaces the `+` and `/` characters with `-` and `_` and typically omits the trailing `=` padding, so the resulting string is safe to use directly in a URL or filename without escaping — regular base64's special characters would otherwise need percent-encoding in a URL.