Random bytes, ready to use
Most symmetric keys are simply random bytes of the right length. AES-256 needs 32 bytes, HMAC-SHA256 works best with 32 bytes or more, and ChaCha20 also uses 32. This generator creates exactly that many bytes with the Web Crypto API and writes them as hex or Base64, the same as openssl rand.
Hex is the most portable format. Base64 is shorter, 44 characters for a 256-bit key compared with 64 in hex. Base64url swaps + and / so the key is safe in URLs and file names.
Which size do I need?
| Size | Bytes | Typical use |
|---|---|---|
| 128-bit | 16 | AES-128, salts, identifiers |
| 192-bit | 24 | AES-192 |
| 256-bit | 32 | AES-256, ChaCha20, HMAC-SHA256, JWT HS256 |
| 384-bit | 48 | HMAC-SHA384, JWT HS384 |
| 512-bit | 64 | HMAC-SHA512, JWT HS512, Rails secret_key_base |
Frequently asked questions
Is a 256-bit key strong enough?
Yes. A 256-bit random key is far beyond any brute-force attack, including foreseeable quantum computers, which at best halve the effective strength of symmetric keys.
Can I use these keys with OpenSSL?
Yes. Hex keys work with openssl enc -K. For most libraries, decode the hex or Base64 into bytes first.