Secret & API Key Generator
Create random secrets from your browser’s cryptographic generator: hex, base64 and base64url of any length, a Laravel APP_KEY, API keys with a prefix, and a .env block.
Runs in your browser — nothing is uploaded.
Random bytes (hex, base64) or characters (API key).
Letters, digits, “_” and “-”. Leave empty for none.
How to use it
- Choose the kind of secret and, where it applies, the number of random bytes.
- Copy the result, or generate several and copy or download them all.
- Put it in your .env file or secret manager. Never commit it to git.
Frequently asked questions
Is the secret sent anywhere?
No. It is generated in your browser with crypto.getRandomValues and never leaves the page. No ads, analytics or third-party scripts load here and nothing is logged.
What is a Laravel APP_KEY?
A 32-byte random key, written as base64: followed by its base64 encoding (the format php artisan key:generate produces). It encrypts cookies and other encrypted values, so keep it secret and do not change it casually in production.
How many bytes do I need?
16 bytes (128 bits) is the minimum for a secret; 32 bytes (256 bits) is the usual choice for signing keys and tokens. HMAC keys are best at least as long as the hash output.
What does the API key kind produce?
An optional prefix, an underscore and random characters from 0–9, A–Z and a–z (about 5.95 bits each). Prefixes such as sk_live make leaked keys easy to spot in code scanning.