Free · Private · Client-side

Secret Key Generator

Generate cryptographically secure secrets for session management, API authentication, and other security-sensitive applications.

Generated values never leave this device.

Length (bytes)

Format

Estimated entropy: 256 bits · 32 random bytes~132,943,112,026,157,700,000,000,000,000 quintillion times the age of the universe to crack

Weak · <50 bitsFairGood · 70+Strong · 100+

In plain terms: a gaming PC guessing a million passwords per second would need 132,943,112,026,157,700,000,000,000,000,000,000 quintillion times the age of the universe. Even someone renting every cloud server on Earth — a trillion guesses per second — would need 132,943,112,026,157,700,000,000,000,000 quintillion times the age of the universe. Nobody is guessing this password; the only realistic risks are it being reused or phished.

Generated secrets

Strong256 bits

Common Uses

.env

# Session secret
SESSION_SECRET=...

# Cookie signing secret
COOKIE_SECRET=...

# CSRF token secret
CSRF_SECRET=...

Express.js session

const session = require('express-session');

app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true,
    httpOnly: true,
    maxAge: 24 * 60 * 60 * 1000 // 24 hours
  }
}));

Choosing secret length

128 bits (16 bytes): Minimum for most applications
256 bits (32 bytes): Recommended for session secrets
512 bits (64 bytes): Maximum security for sensitive operations

Bulk Generation

Generatesecrets

Generate in Terminal

Base64

$openssl rand -base64 32

Hexadecimal

$openssl rand -hex 32

URL-safe (Python)

$python3 -c "import secrets; print(secrets.token_urlsafe(32))"

Node.js

$node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"