Which format should I choose for an application secret?

Use a 32-byte Base64URL token unless the framework or API documents a different format. It is compact, URL-safe, and supplies 256 bits of randomness.

Are generated secrets uploaded or stored?

No. Generation uses your browser's Web Crypto API. Values stay in this tab until you copy them, and the tool does not save or transmit them.

Does an API-key prefix make a secret stronger?

No. A prefix such as sk_live_ is helpful for identification, but it is predictable. Only the generated random portion contributes entropy.

Should I use a UUID as a secret?

UUID v4 values are excellent random identifiers, but a 32-byte token is a better default for credentials because it has more entropy and is designed for secret use.

Can I reuse the same secret in development and production?

No. Generate separate values for every environment. This limits the impact of accidental exposure and makes rotation safer.

←

Secret Generator

Developers

Files & input stay local

Secret settings

FormatBest default for API keys, session secrets, and environment variables.Values to generateGenerate up to 20 independent values at once.

Optional prefixA label for your system; it does not add entropy.

Random bytes32

256 bits of randomness.

Generated values

Choose a format and generate a cryptographically random value.

Loading tool…

How to use Secret Generator · guide, tips & FAQs

Generate cryptographically secure API keys, tokens, hex secrets, and UUIDs locally in your browser.

What is Secret Generator?

Secret Generator creates cryptographically secure random values for API keys, .env variables, session secrets, webhook verification, and token signing. Choose a URL-safe token, hex secret, alphanumeric token, or UUID v4, then copy the result. Randomness comes from your browser's Web Crypto API and never leaves your device.

Secret values are generated locally with Web Crypto. They are never uploaded, logged, or saved by PrivacyTools.

How to use Secret Generator

1Choose Base64URL token for most application secrets, or select the exact format your service requires.
2Set the value size and optional prefix. A prefix is only a label and does not increase security.
3Generate one or more values, then copy and store them in your password manager or secret manager.
4Add the value to your local .env file or deployment secret store. Do not commit it to source control.

Examples

Application session secret

32 random bytes provide 256 bits of entropy and work well for most modern frameworks.

SESSION_SECRET=Base64URL token generated with 32 random bytes

Prefixed API key

The visible prefix identifies the key type; only the generated token provides randomness.

sk_live_<random Base64URL token>

Tips & common mistakes

Use a 32-byte Base64URL token as the default when documentation does not specify a format or length.
Use hex only when the receiving system requires hexadecimal characters; it is longer than Base64URL for the same entropy.
Generate a different secret for every environment and rotate a secret immediately if it is exposed.
Store production values in a secret manager or hosting provider's encrypted environment-variable settings.

Who uses this tool?

Creating authentication, cookie, or session secrets for a web application.
Generating API tokens and webhook verification secrets for integrations.
Creating random values for local development and automated test environments.
Generating non-sequential public identifiers when a UUID format is required.

Frequently asked questions

Which format should I choose for an application secret?: Use a 32-byte Base64URL token unless the framework or API documents a different format. It is compact, URL-safe, and supplies 256 bits of randomness.
Are generated secrets uploaded or stored?: No. Generation uses your browser's Web Crypto API. Values stay in this tab until you copy them, and the tool does not save or transmit them.
Does an API-key prefix make a secret stronger?: No. A prefix such as sk_live_ is helpful for identification, but it is predictable. Only the generated random portion contributes entropy.
Should I use a UUID as a secret?: UUID v4 values are excellent random identifiers, but a 32-byte token is a better default for credentials because it has more entropy and is designed for secret use.
Can I reuse the same secret in development and production?: No. Generate separate values for every environment. This limits the impact of accidental exposure and makes rotation safer.