Is it safe to generate a secret in a web page?

This page generates values with your browser’s own cryptographic random number generator and makes no network request, so the value exists only on your screen until you copy it. If your policy forbids browser-generated secrets, use the shell command shown under the result.

How long should a JWT secret be?

At least as long as the hash output of the algorithm: 256 bits (32 bytes) for HS256, 384 bits for HS384, and 512 bits for HS512, as RFC 7518 section 3.2 requires.

What is the difference between base64 and base64url?

Base64url replaces `+` and `/` with `-` and `_` and drops the `=` padding, so the value can sit in a URL, a file name, or a header without escaping. Both carry the same number of random bits.

Are the generated values stored anywhere?

No. They are not sent to Shortspan or saved in your browser. Reloading the page discards them.

Free tool · no account

Random secret generator

Generate API keys, JWT signing secrets, hex and base64 tokens, passwords, and UUIDs. Everything is generated in your browser by the Web Crypto API; nothing is sent anywhere or saved.

Format

Random bytes (16–128)

JWT HMAC secret

How many

Same thing in a terminal

openssl rand -base64 32 | tr -d '\n=' | tr '+/' '-_'

Prints a new random value each time; this page never sees it.

Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.

Next step

Then keep it out of chat and .env files

Store it once with shortspan secret set NAME - the CLI prompts for the value, so it never lands in your shell history - and inject it into the process that needs it with shortspan run.

Create a free workspace See what Shortspan does

How the values are generated

Bytes come from crypto.getRandomValues, the browser’s cryptographically secure random number generator. Characters for API keys and passwords are chosen by rejection sampling: a random byte that would make some characters more likely than others is thrown away rather than wrapped with a remainder, so every character is equally likely.

The entropy shown is the number of random bits in the value. 128 bits is beyond brute force; 256 bits is the usual choice for signing and encryption keys. A prefix such as sk_live_ makes a key recognisable to you and to secret scanners, but adds no entropy.

Choosing a format

Hex is the most portable: it survives URLs, shells, and config files without escaping. Base64url packs the same randomness into fewer characters and is safe in URLs and file names; standard base64 can contain +, /, and =, which some parsers mangle.

For JWT HMAC signing, RFC 7518 requires a key at least as long as the hash: 32 bytes for HS256, 48 for HS384, 64 for HS512. The presets set exactly that.

Generate it without this page

For hex, base64, base64url, and UUIDs the tool shows the equivalent shell command - usually openssl rand - so you can produce the same kind of value on any machine with OpenSSL installed.

Common questions

Is it safe to generate a secret in a web page?: This page generates values with your browser’s own cryptographic random number generator and makes no network request, so the value exists only on your screen until you copy it. If your policy forbids browser-generated secrets, use the shell command shown under the result.
How long should a JWT secret be?: At least as long as the hash output of the algorithm: 256 bits (32 bytes) for HS256, 384 bits for HS384, and 512 bits for HS512, as RFC 7518 section 3.2 requires.
What is the difference between base64 and base64url?: Base64url replaces + and / with - and _ and drops the = padding, so the value can sit in a URL, a file name, or a header without escaping. Both carry the same number of random bits.
Are the generated values stored anywhere?: No. They are not sent to Shortspan or saved in your browser. Reloading the page discards them.

More free tools