Encryption key generator — random AES, ChaCha20 and HMAC keys

How to use the encryption key generator

1. Choose a Key type: AES-128, AES-192 or AES-256, ChaCha20 / XChaCha20, an HMAC-SHA256 or HMAC-SHA512 key, or Custom number of bytes (1 to 1,024).
2. Pick an Encoding: Hex, Base64 or Base64url.
3. Under Also generate, choose Key only or add a 12-byte nonce, 16-byte IV or 24-byte nonce.
4. Set How many keys (up to 50) and press Generate. Copy the key list, and the IV or nonce list if you asked for one.

What it does and when to use it

Symmetric ciphers and message-authentication codes need a secret key of a fixed size: 16, 24 or 32 bytes for AES, 32 bytes for ChaCha20, and commonly the hash’s output length for HMAC (32 bytes for SHA-256, 64 for SHA-512). This tool gives you exactly that many random bytes in the text format your code or config expects.

Typical uses are a SECRET_KEY for signing session cookies, an AES-256 key for encrypting a backup, an HMAC key for verifying webhooks. For a password a person must type, use the strong password generator instead. To turn a password into a key, use a slow function such as the PBKDF2 generator.

How it works

Each key is a call to crypto.getRandomValues for the chosen number of bytes. Nothing is mixed in or hashed afterwards; the bytes are simply encoded. Because every bit is independently random, a key of n bytes has n × 8 bits of entropy, which is what the Key size figure reports. Guessing a 256-bit key is not a practical attack.

The IV or nonce list is drawn the same way, one per key, in the same encoding.

Worked examples

• AES-256 in hex. Key type AES-256, Encoding Hex. The result is one 64-character hex string, plus Key size: 256 bits and Bytes: 32.
• HMAC-SHA512 in Base64. The tool draws 64 bytes, so the stats show Bytes: 64 and a key size of 512 bits. The Base64 text is 88 characters long.
• Asking for too much. Custom with 5,000 bytes is capped at the 1,024-byte limit, and the stats read Key size: 8192 bits.

Limits and tips

• A key is only as safe as its storage. Never commit it to Git; rotate it if it leaks.
• Never reuse a nonce with the same key. With AES-GCM that mistake can expose the authentication key.
• Output is raw key material, not a key file. Tools that expect PEM, JWK or a keystore need a different format.
• For long random tokens that are not keys, the random hex generator or the API key generator may fit better.