Base64 Key Generator

How to generate a key

1. Click the preset that matches what you are configuring. 32 bytes is selected when the page opens.
2. Copy the value from Random values. Presets with a config line, such as Laravel or Auth.js, also show it under Ready to paste.
3. Press Generate new for another key, or raise How many to create several at once, for example one per environment.

Presets set the byte count and format for you. Change either field and the tool switches back to Custom, keeping your values.

Presets and where each key goes

The CSP nonce preset belongs to a different job; it has its own page, the CSP nonce generator.

The sizes follow the algorithms. AES keys are exactly 16, 24 or 32 bytes; anything else is rejected. RFC 7518 requires HS256 secrets of at least 256 bits, which is why the JWT preset uses 32 bytes. An HMAC key shorter than the hash output weakens HMAC, so 32 bytes suits HMAC-SHA256 and the 64-byte preset suits HMAC-SHA512. The Django preset draws its 50 characters by rejection sampling, so every character of the alphabet is equally likely, the same way Django’s own get_random_secret_key() behaves.

A Base64 key is text, the key is bytes

The value you copy is a Base64 representation of random bytes. Code that uses it must decode it first:

import base64, os

key = base64.b64decode(os.environ["AES_KEY"])
assert len(key) == 32

In Node.js the same is Buffer.from(process.env.AES_KEY, "base64"). If you hand the 44-character string straight to an AES library, it either rejects it (AESGCM key must be 128, 192, or 256 bits in Python, Invalid key length in Node.js) or, in looser libraries, uses the wrong bytes without complaint. Frameworks that read their own keys, such as Laravel with its base64: prefix, do this decoding for you.

Base64URL and standard Base64 decode to the same bytes, but parsers are often strict about which one they accept. Keep the format the preset produced unless you know the consumer accepts the other.

Fernet keys and other formats

Python’s cryptography package expects a Fernet key as 32 bytes in URL-safe Base64 with padding, 44 characters. The JWT and API token presets give the URL-safe form without the =, so add one at the end, or generate it in Python:

from cryptography.fernet import Fernet

print(Fernet.generate_key().decode())

For anything else, work from the byte count: pick Custom, enter the bytes your library documents, and choose Base64, Base64URL or hex. The random Base64 generator explains output lengths, and HMAC in Base64 or AES encryption let you try a fresh key straight away.

Handling keys after generating them

A key generated here exists only in this tab until you copy it. After that it is as safe as the place you paste it into. Keep production keys in your platform’s secret store or a secrets manager, use a different key per environment, and never commit them; a key that reached a Git repository should be considered public and replaced. Rotating an encryption key means re-encrypting old data or keeping the old key for decryption, so plan for that before you swap an APP_KEY on a live system.

FAQ