Hex Key Generator
Generate random hex keys for JWT secrets, API tokens, and encryption keys. Pick a size (128 / 256 / 512 bits) or a custom byte count.
256 bits = 32 bytes = 64 hex characters
How to use this hex key generator
A hex key is a string of hexadecimal digits (0-9, a-f) derived from random bytes. Hex is a convenient way to represent raw key material because every two characters stand for one byte — so a 32-character hex string is a 128-bit key, and a 64-character hex string is a 256-bit key. Every byte comes from the same secure-random source your browser uses to negotiate HTTPS connections.
- Pick a key size. 128-bit is fine for AES-128 and most HMAC use. 256-bit is the modern default for AES-256, JWT HS256 secrets, and application signing keys. 512-bit is what you want for HS512 or when you are paranoid.
- Set a count. Generate multiple keys in one shot if you are seeding several environments (dev/staging/prod) or rotating a batch of secrets.
- Copy and store. Paste into your secrets manager (Vault, AWS Secrets Manager, 1Password, Doppler) immediately. Hex keys are useless to humans but attacker gold if leaked.
What not to do with a hex key. Do not put it in source control, do not paste it into a chat, and do not use the same key across environments. If a key leaks, rotate it everywhere it was used. For JWT, rotating the signing key invalidates every outstanding token — which is the whole point.
Why hex instead of base64? Both encode bytes. Hex is slightly longer (2 characters per byte vs ~1.33) but is shell- and URL-safe without escaping, and every byte is exactly two characters — easy to visually verify length.