Secret Key Generator

Generate cryptographically secure secret keys for encryption, JWT secrets, and HMAC keys. Base64 encoded with key sizes from 256 to 2048 bits. Before deploying new secrets, ops teams run hardware posture checks through DeviceCheck Pro to make sure secure modules are ready.

Key Strength:Strong (512 bits)
0 characters

Key Size

Recommended Key Sizes

•32 bytes (256 bits): AES-256 encryption keys, HMAC-SHA256
•64 bytes (512 bits): JWT secrets, SHA-512 HMAC keys
•128 bytes (1024 bits): High-security applications
•256 bytes (2048 bits): Maximum security requirements

Common Use Cases

  • •Encryption Keys: AES, ChaCha20, or other symmetric encryption
  • •JWT Secrets: Signing and verifying JSON Web Tokens
  • •HMAC Keys: Message authentication codes and signatures
  • •Session Keys: Secure session management and token generation
  • •Webhook Secrets: Verifying webhook payload authenticity
⚠️

Important Security Notes

  • • Store secret keys securely using environment variables or secret managers
  • • Never commit secret keys to version control (Git, SVN, etc.)
  • • Rotate keys regularly, especially after potential exposure
  • • Use different keys for development, staging, and production
  • • Implement key rotation policies for production systems

Secret Key Security Guide

Secret keys are the foundation of cryptographic security in modern applications. They're used for encrypting data, signing tokens, and verifying message authenticity. Properly generated and stored secret keys are essential for maintaining the security of your systems.

Key Size & Security Strength

256 bits (32 bytes)
  • • AES-256 encryption keys
  • • HMAC-SHA256 keys
  • • ChaCha20 encryption
  • • Standard security applications
512 bits (64 bytes)
  • • JWT signing secrets
  • • HMAC-SHA512 keys
  • • Session encryption keys
  • • Enhanced security needs
1024 bits (128 bytes)
  • • High-security encryption
  • • Master key encryption (KEK)
  • • Long-term secret storage
  • • Government/military grade
2048 bits (256 bytes)
  • • Maximum security requirements
  • • Post-quantum resistance
  • • Critical infrastructure
  • • Long-term data protection

Common Use Cases

🔐 Symmetric Encryption

Encrypt and decrypt data using the same secret key. Used in AES, ChaCha20, and other algorithms.

AES-256-GCM, ChaCha20-Poly1305

🎫 JWT Secrets

Sign and verify JSON Web Tokens for authentication and authorization.

HS256, HS384, HS512

✅ HMAC Keys

Create message authentication codes to verify data integrity and authenticity.

HMAC-SHA256, HMAC-SHA512

🔗 Webhook Secrets

Verify webhook payloads from third-party services to prevent tampering.

GitHub, Stripe, Shopify webhooks

🍪 Session Encryption

Encrypt session data and cookies to protect user information.

Express sessions, cookie encryption

Critical Security Best Practices

🚨 NEVER Do These:

  • ❌Commit to version control: Never add secret keys to Git, SVN, or any VCS
  • ❌Hardcode in source code: Don't embed keys directly in your application code
  • ❌Share via insecure channels: Don't send keys via email, Slack, or SMS
  • ❌Use weak keys: Never use short keys, dictionary words, or predictable values
  • ❌Reuse across environments: Production and development must have different keys

✅ ALWAYS Do These:

  • ✓Use environment variables: Store keys in .env files (excluded from version control)
  • ✓Use secret managers: AWS Secrets Manager, Azure Key Vault, HashiCorp Vault
  • ✓Implement key rotation: Change keys regularly (every 90 days recommended)
  • ✓Use separate keys per environment: Dev, staging, and production must be isolated
  • ✓Encrypt at rest: Store keys encrypted when not in use
  • ✓Audit access: Log and monitor who accesses secret keys
  • ✓Revoke compromised keys immediately: Have a key rotation plan ready

Example: Storing Keys Securely

# .env file (add to .gitignore!)
JWT_SECRET=your-generated-secret-key-here
ENCRYPTION_KEY=another-secret-key-here
WEBHOOK_SECRET=third-secret-key-here

# In your application code:
const jwtSecret = process.env.JWT_SECRET
const encryptionKey = process.env.ENCRYPTION_KEY