Secret generator
Generate a strong random secret (app secret, session key, JWT secret) in hex, base64url or alphanumeric.
Generated locally via crypto.getRandomValues — nothing is sent.
🔒 100% client-side — no data sent
Generate a strong random secret for your app secret, session key or JWT secret, in hex, base64url or alphanumeric format, with adjustable length. Generation uses crypto.getRandomValues and runs 100% in your browser: no secret is ever sent to or stored on a server.
What is it for?
- ▸ Create a JWT_SECRET to sign your tokens.
- ▸ Generate a session key for Express, Django or Rails.
- ▸ Fill a .env file with a solid APP_SECRET.
- ▸ Produce an encryption key for your environment variables.
FAQ
How long should a JWT secret be?
At least 256 bits (32 bytes) for HS256, i.e. about 64 hexadecimal characters. Longer never hurts.
Hex, base64url or alphanumeric: which one?
Hex is the most universal, base64url is more compact and URL-safe, alphanumeric avoids special characters that can break config files.
Is this secret generator secure?
Yes: it relies on crypto.getRandomValues (cryptographically secure) and everything stays in your browser, nothing is transmitted.
Can I reuse the same secret across environments?
No, generate a distinct secret per environment (dev, staging, prod) to limit the impact of a leak.