Random Secret Generator — JWT, API Keys, Hex + Base64
Random secret generator online — generate cryptographically secure JWT secrets, API keys, webhook signing keys. Hex, Base64, prefix presets. Free.
PDFFlare's random secret generator produces cryptographically secure secrets in any format your stack expects: hex, base64, base64url, or alphanumeric. Use it as a jwt secret generator (HS256 / HS384 / HS512), an api key generator online for your own services, a webhook signing secret generator (Stripe-style whsec_ prefix included), or a generic random hex string generator for encryption keys, salts, and CSRF tokens. Secrets are generated locally with crypto.getRandomValues(); nothing is transmitted.
One-click presets cover the common cases: JWT HS256 (256-bit base64), JWT HS512 (512-bit base64), API key (256-bit base64url with api_ prefix), Stripe webhook (whsec_ + 256-bit hex), AES-256 encryption key (256-bit hex). Or configure manually with bit length (128 / 192 / 256 / 384 / 512), format, prefix, and bulk quantity (1 / 5 / 10 / 25 / 50). Pair the generated key with PDFFlare's HMAC Generator to sign webhook payloads, the JWT Decoder to inspect tokens you sign with it, or the Password Generator for human-readable credentials instead.
Acts as a secure random string generator, encryption key generator online, and random base64 string generator — all in one page. Free, unlimited, no signup. Preferences persist across reload via localStorage; generated secrets never do.
Quick presets
Result will be 64 characters of hex (256 bits of entropy).
Generated locally in your browser using crypto.getRandomValues() — the same CSPRNG that backs WebAuthn, TLS, and key generation in Web Crypto. Secrets are never sent to PDFFlare or any server, and are not stored in localStorage (only your format / length / prefix preferences are remembered).
How to Generate a Random Secret
Pick a preset (or skip if you know what you need)
Click JWT HS256 secret, API key, Stripe webhook secret, AES-256 encryption key, or JWT HS512 secret to set the right length and format with one click. Or configure manually below.
Choose length and format
Bit length controls entropy — 256-bit (32 bytes) is the standard for JWT HS256, Stripe signing keys, and most API tokens. Pick a format: hex (most common), base64 (JWT secrets), base64url (URL-safe / JWT signature side), or alphanumeric (clean tokens with no symbols).
Add a prefix if needed
Pick a prefix to mimic Stripe (sk_live_, sk_test_), GitHub PATs (ghp_), webhook secrets (whsec_), generic API keys (api_), or enter a custom prefix like mykey_. Useful when your code looks for a specific format.
Generate, copy, paste into your .env
Click Generate. Each secret has its own Copy button; if you generated multiple, Copy all puts them on the clipboard newline-separated. Paste into your .env, JWT_SECRET environment variable, or wherever your code reads the secret. The page never sees the values.
When Do You Need a Random Secret?
JWT signing key for your API: JWT HS256 needs a 256-bit shared secret to sign tokens. Use the JWT HS256 preset, paste the result into JWT_SECRET in your .env, and your tokens are cryptographically authentic. Switch to JWT HS512 if your auth library is configured for it. The same secret signs and verifies, so both your API server and your auth service need to read it from the same env var.
Webhook signing secret (Stripe / GitHub / Slack-style): When you send webhooks to clients, sign each payload with an HMAC of the body using a secret you share with the receiver. Use the Stripe webhook secret preset (whsec_ + 256-bit hex) for Stripe-style format, or pick whichever prefix matches your convention. Pair this with PDFFlare's HMAC Generator to test your signing logic.
API keys for a service or beta launch: Need to mint 50 API keys for a beta cohort? Pick the API key preset, set quantity to 50, click Generate, copy all. Each key is a 256-bit base64url string with an api_ prefix — long enough to be unguessable, URL-safe enough to embed in headers without escaping, and recognizable by prefix when scanning logs.
Encryption keys for AES-256, libsodium, or KMS imports: AES-256 needs a 256-bit key. Use the AES-256 encryption key preset for 64 hex characters that you can paste into an HSM, KMS, or encryption library directly. For libsodium's secretbox you may want base64 instead — just switch format to Base64 and the same 32 random bytes encode differently.
Why Use PDFFlare's Random Secret Generator?
Cryptographically Secure
Uses crypto.getRandomValues() — the W3C Web Cryptography CSPRNG that backs WebAuthn and TLS. Not Math.random(). Alphanumeric mode uses rejection sampling for zero modulo bias.
One-Click Presets for the Common Cases
JWT HS256 / HS512 secrets, API keys (api_ prefix + base64url), Stripe webhook secrets (whsec_ prefix), AES-256 encryption keys. Five presets cover 90% of what most engineers need.
100% Browser-Based
Secrets generate locally — no request to PDFFlare, nothing transmitted, nothing logged. Verify by checking DevTools → Network. Your format / length / prefix preferences persist across reload; the secrets themselves never do.
No Signup Required
Free, unlimited, no account. Bulk generate up to 50 at once, copy individually or all-at-once newline-separated. Plus 5 formats × 5 lengths × 7 prefixes = the right combination for almost any use case.