Generate JWT secrets (HS256, HS384, HS512), Laravel APP_KEY, Django SECRET_KEY, Rails, Auth.js and Flask keys, plus API keys and tokens, with real entropy and the equivalent command.
A secret is only as strong as the randomness that made it. The tool uses crypto.getRandomValues only, the browser cryptographic generator, never Math.random, and draws symbols by rejection sampling so none is favored: with 62 symbols, taking a byte modulo 62 would make the first 8 symbols come up 25% more often (256 = 4 x 62 + 8), so bytes from 248 to 255 are discarded. Entropy is the size of the search space in bits: length times log2 of the alphabet. A 32-byte hex has 256 bits; 32 alphanumeric characters, about 190.5; the 50 Django characters, about 282; a UUID v4, 122. The formats follow what each framework does: Laravel APP_KEY is base64: plus 32 bytes (16 for AES-128); Rails SECRET_KEY_BASE is 64 bytes in hex, as in bin/rails secret; Flask documents secrets.token_hex(); and JWT HMAC secrets have at least 256, 384 and 512 bits for HS256, HS384 and HS512, per RFC 7518. For every format the page shows the equivalent command in OpenSSL, Python or the framework own tool.
Paste the code into your HTML and the tool shows up on your page, without J-Kit's navigation and ads. It still runs in the browser of whoever visits your site.
<iframe
src="https://jkit.tools/embed/en-US/secret-key-generator"
width="100%"
height="600"
style="border:0"
loading="lazy"
title="Secret and API Key Generator"
></iframe>These references help contextualize formulas, standards, APIs and limitations used on this page. They do not replace professional validation when a result has legal, financial, medical or operational impact.
Use at least 32 random bytes (256 bits): RFC 7518, section 3.2, says the HMAC key must be the size of the hash output or larger, that is 256 bits for HS256, 384 for HS384 and 512 for HS512. A short phrase or dictionary word as the secret can be cracked by offline brute force from a single token.
Random bytes in hexadecimal: 2 characters per byte. 32 bytes give 64 characters and 256 bits.
openssl rand -hex 32python3 -c "import secrets; print(secrets.token_hex(32))"Pick the variables and copy the block. Each generation draws new values; values with $, # or spaces come out quoted.
Turn on at least one variable.
For production, prefer generating locally with the terminal command. Any secret typed or copied from a web page should be treated as exposed if you do not trust the device or the browser extensions. Nothing here is sent or stored.