Random Hex Secret Generator
Cryptographically secure random bytes, hex-encoded — for API keys and app secrets.
$ openssl rand -hex 32
What is a hex secret?
A hex secret is a sequence of cryptographically random bytes encoded as hexadecimal — two characters per byte, using only 0-9 and a-f. 32 random bytes become a 64-character string carrying a full 256 bits of entropy. Hex is the least dense encoding but the most portable: no padding, no special characters, safe in URLs, config files, shell commands and environment variables without any escaping.
Common uses
Random hex strings are the standard shape for framework secrets: Rails' secret_key_base, Django's SECRET_KEY, Flask's SECRET_KEY, Express/cookie signing secrets, webhook signing tokens, or raw key material for AES-256 (32 bytes) and HMAC. This generator is the browser equivalent of openssl rand -hex 32 — same entropy, no terminal needed.
Which size should I pick?
32 bytes (256 bits) is the safe default and matches what AES-256 and SHA-256-based HMACs expect. 16 bytes (128 bits) is still computationally unbreakable and fine for identifiers and salts; 64 or 128 bytes only make sense when a spec explicitly asks for a longer key. The bytes are produced by crypto.getRandomValues() on your device and never leave your browser.
How many bytes should I pick?
32 bytes (256 bits) is the safe default and matches what AES-256 and SHA-256-based HMACs expect. 16 bytes (128 bits) is still computationally unbreakable and fine for identifiers and salts. Go to 64 or 128 only when a specification explicitly asks for it — a longer key does not make a 256-bit algorithm stronger.
Is this the same as openssl rand -hex 32?
Yes — same byte count, same encoding, same class of random source. openssl draws from your OS CSPRNG; this page draws from your browser's, which is seeded by the same OS. The difference is that nothing here is typed into a shell that records history.
Why is 32 bytes 64 characters?
Hex encodes one byte as two characters, so the printed string is always double the byte count. The entropy is in the bytes, not the characters: 32 bytes is 256 bits whether you print it as 64 hex characters or 43 base64 ones.
Nothing leaves your browser
- Don't take our word for it — turn off your wifi. Every generator on this site keeps working with the network disconnected. That's the whole proof, and it takes five seconds.
- Every value comes from
crypto.getRandomValues()— the CSPRNG built into your browser, neverMath.random(). - Generated secrets are never transmitted, logged or stored: no server-side generation, no cookies, no localStorage.
- Verify it yourself in the network tab: after loading, the page only talks to our self-hosted, cookie-less analytics — which counts page views and which generator type gets copied, never any value.
- Strict Content-Security-Policy; no third-party script origins.
All generators
- Base64 Secret Generator
- UUID Generator
- Password Generator
- JWT Secret Generator
- Passphrase Generator
- SSH Key Generator (Ed25519)
- PIN Generator
- WireGuard Key Generator
- API Key Generator
- TOTP Secret Generator
- Django SECRET_KEY Generator
- Laravel APP_KEY Generator
- NextAuth Secret Generator
- Flask SECRET_KEY Generator
- Rails secret_key_base Generator
- Strapi APP_KEYS Generator
- ULID Generator
- Nano ID Generator