Generate keys, secrets & passwords in your browser
Eight generators for developers, all powered by the Web Crypto API. No server-side generation, no storage, no accounts.
- Base64 Secret Generator
- UUID Generator
- Password Generator
- Hex Secret Generator
- JWT Secret Generator
- Passphrase Generator
- SSH Key Generator (Ed25519)
- PIN Generator
Base64 Secret Generator
$ openssl rand -base64 32
Random secrets encoded as base64 or URL-safe base64url. Learn more →
UUID Generator
$ uuidgen
Random UUID v4 and time-ordered UUID v7 identifiers, RFC 9562 compliant. Learn more →
Password Generator
$ pwgen -s 20 1
Strong random passwords with full control over length and character sets. Learn more →
Hex Secret Generator
$ openssl rand -hex 32
Cryptographically secure random bytes, hex-encoded — for API keys and app secrets. Learn more →
JWT Secret Generator
$ openssl rand -base64 32
Signing keys for JWT HMAC algorithms — 256-bit for HS256, 512-bit for HS512. Learn more →
Memorable Diceware passphrases from the EFF large wordlist. Learn more →
SSH Key Generator (Ed25519)
$ ssh-keygen -t ed25519
A ready-to-use Ed25519 key pair in OpenSSH format, generated locally. Learn more →
Uniformly random numeric PIN codes with no patterns. Learn more →
Nothing leaves your browser
- Every value comes from
crypto.getRandomValues()— the CSPRNG built into your browser, neverMath.random(). - Generated secrets are never transmitted, logged or stored: no server-side generation, no cookies, no localStorage.
- Verify it yourself in the network tab: after loading, the page only talks to our self-hosted, cookie-less analytics — which counts page views and which generator type gets copied, never any value.
- Strict Content-Security-Policy; no third-party script origins.
Is it safe to generate passwords and keys in a browser?
Yes — with the right architecture. Every generator on this site runs entirely in your browser using the Web Crypto API (crypto.getRandomValues), the same CSPRNG your operating system provides to native tools. Generated values are never transmitted, logged or stored, which you can verify in your browser's network tab. For long-lived, high-value keys such as a production SSH key, generating locally with ssh-keygen remains the gold standard.
Why is this free? What's the catch?
There is no catch. The site is a static page with no accounts, no ads and no paywalls. The only thing measured is anonymous, self-hosted analytics: page views and which generator type gets copied — never any generated value.
How random are the generated secrets?
All randomness comes from crypto.getRandomValues, a cryptographically secure random number generator seeded by your operating system. Values are drawn with rejection sampling, so every character, word or byte is exactly equally likely — no modulo bias, and never Math.random.
Which generator should I use for an API key or app secret?
Use 32 random bytes: hex if you need maximum portability, base64url if you want a shorter string that is still URL-safe. Both carry 256 bits of entropy — the same strength as an AES-256 key. For JWT HS256 signing secrets, use the dedicated JWT secret generator.