Skip to tool
All tools
FeuTex · free tools runs in-browser no bloat built by LiMiT

Online Base64 Key Generator

Generate a cryptographically secure random key and encode it as Base64 or Base64URL. Useful for API tokens, secrets, session keys, and JWT HMAC secrets.

Category: Developer · URL: /tools/online-base64-key-generator.html
Entropy ≈ 256 bits
Bytes: 0 • Base64 chars: 0
Note: Base64 is encoding, not encryption. Keep generated secrets private.
Privacy: runs locally in your browser. No uploads, no tracking scripts.

How to use

Use this generator to create a strong, random key and encode it as Base64.

  1. Choose the key length in bytes (common: 32 for 256-bit, 64 for 512-bit).
  2. Select Base64 or Base64URL (recommended for JWT/URLs).
  3. Toggle padding (=) on/off if needed by your library.
  4. Click Generate, then Copy the result.
Keywords this page targets (natural cluster): online base64 key generator, base64 random key generator, base64url key generator, generate base64 secret, jwt secret base64url, secure random key base64, random token base64, create base64 api key, base64 string generator secure, generate 32 byte key base64, generate 64 byte secret base64, base64 key with no padding, base64url without padding, crypto random base64, convert random bytes to base64, base64 secret for env var, hs256 secret generator, hmac key base64 generator
Secondary intents covered: Generate a secure random secret for JWT (HS256/HS512), Create an API key/token in Base64 or Base64URL format, Pick the right key size (bytes) for a secret, Generate Base64 without padding for URL-safe usage, Copy a key quickly for .env or configuration files, Get both Base64 and hex versions of the same random key, Understand whether Base64 is encryption or just encoding, Avoid weak randomness by using browser cryptography

FAQ

Is this key generator cryptographically secure?

Yes, it uses crypto.getRandomValues in your browser to generate random bytes.

What key length should I use?

For most secrets, 32 bytes (256-bit) is a solid default; use 64 bytes if you want extra margin.

Base64 vs Base64URL: what’s the difference?

Base64URL replaces + and / with - and _ so the value is URL/JWT-safe.

Should I include padding (=)?

Many JWT and URL-safe uses omit padding; some libraries expect standard padded Base64, so match your target system.

Is Base64 the same as encryption?

No—Base64 is only an encoding. Anyone can decode it, so treat the key as a secret and store it securely.

Can I use this for JWT HS256/HS512 secrets?

Yes. Generate at least 32 bytes for HS256; longer is fine as long as your verifier uses the same secret bytes.

Why does the same byte length produce a longer Base64 string?

Base64 encodes every 3 bytes into 4 characters, so the text grows by about 33% (less if you remove padding).