About GenerateKey

What it is

GenerateKey is a set of generators for the random values developers actually need — passwords, Diceware passphrases, UUIDs, hex and base64 secrets, JWT and framework secrets, SSH and WireGuard keys, and more. Every one runs entirely in your browser through the Web Crypto API (crypto.getRandomValues and crypto.subtle). There is no server-side generation, no account, no cookie, no ad, and nothing that records a generated value. The only network traffic after the page loads is a self-hosted, cookie-less page-view count that stores which generator type was copied — never the value.

How to verify that, in five seconds

Don't take our word for it. Turn off your wifi and press generate — every generator keeps working, because the randomness comes from your own device, not a server. For the thorough version, open your browser's Network tab and press generate: you will see no request at all. And you can read the exact JavaScript this page runs — it is served unminified, and it is the entire program. This is the same argument spelled out on is it safe to use an online password generator.

What we actually checked

The correctness claims here are measured, not asserted. Every generator draws with rejection sampling, so there is no modulo bias — a chi-square goodness-of-fit test over 500,000 draws confirms uniformity at alphabet sizes 10, 32, 50 and 64, where the naive byte % n that many online generators ship fails badly for sizes that do not divide 256 (Django's 50-character alphabet is the textbook case). A browser-generated WireGuard key pair was re-derived out of band and matches wg genkey byte for byte. The base32 encoder passes all six RFC 4648 §10 test vectors. The framework secrets reproduce each framework's own output: Laravel's base64: key, Django's 50-character charset, Rails' 128 hex characters, a NextAuth AUTH_SECRET in standard base64.

The honest limits

Client-side generation moves the trust question, it does not remove it. You are trusting that the code served to you does what it claims, and the page is re-fetched on every visit — so a malicious operator, or anyone who compromises the DNS or CDN, could serve different code tomorrow. That is why a secret protecting something irreplaceable should be generated with a tool you installed, why the SSH page tells you to prefer ssh-keygen for a production key, and why this site will never publish a crypto-wallet seed-phrase generator. The threat model scales with the value of the secret, and we would rather say so than pretend otherwise.

Who made it, and how to reach us

Built by maxbook. If you find a security or correctness problem, email max@maxken.fr — there is a security.txt with the same contact.