Encryption Key Generator
Free encryption key generator — symmetric keys for AES-GCM, ChaCha20-Poly1305 and other ciphers, in hex, Base64 and more, with a matching IV or nonce. Each cipher is marked recommended, legacy or broken. Runs locally in WebAssembly.
Runs entirely in your browser — nothing you enter is uploaded or stored.
Symmetric keys
A symmetric key is just random bytes of the right length — the interesting decisions are which cipher will consume it, and how you handle the initialisation vector that goes alongside.
Prefer AEAD where you use the key
This tool produces key material for a cipher family; the mode is chosen in your own code, and it is the more consequential decision. An AEAD mode (GCM, ChaCha20-Poly1305, SIV) produces ciphertext with an authentication tag attached, so any modification is detected on decryption. The older modes — CBC, CTR — provide confidentiality only. Used alone they let an attacker alter ciphertext in ways that change the plaintext predictably, which is how padding-oracle attacks work. If you use them you must add a MAC yourself, encrypt-then-MAC, and that is a thing people get wrong.
The IV is not a secret, but it must be unique
IVs are transmitted in the clear alongside the ciphertext; that is fine and expected. What is not fine is reusing one. Under GCM, encrypting two different messages with the same key and IV reveals the XOR of the plaintexts and can leak the authentication subkey, which turns a confidentiality problem into a forgery problem. Random 96-bit nonces are safe up to a few billion messages per key; beyond that use a counter.
Frequently asked questions
Which cipher should I pick?
AES or ChaCha20 unless something forces your hand. AES is hardware-accelerated on every modern CPU; ChaCha20 is constant-time in software and usually faster where AES instructions are absent, which in practice means older phones and small embedded devices. This tool generates the key material — the mode you pair it with (GCM, and not CBC) is a decision made where you use the key.
Is AES-256 meaningfully safer than AES-128?
Not against any attack that exists. AES-128 is beyond brute force by an enormous margin. AES-256 is chosen for compliance requirements and for a margin against future cryptanalysis, not because AES-128 is falling. The mode you use matters far more than the key size — AES-128-GCM is a better choice than AES-256-CBC.
Can I reuse the IV?
No, and this is the failure that breaks real systems. Reusing an IV with the same key under GCM or ChaCha20-Poly1305 leaks the XOR of the plaintexts and can expose the authentication key, which lets an attacker forge messages. Generate a fresh IV for every message — it does not need to be secret, only unique.
Is the key generated on a server?
No. It comes from a cryptographic random source inside a WebAssembly module in this page. Nothing is transmitted, and there is no endpoint on this site that could receive it. Still: a key you paste into any web page should be treated as one you might have to rotate.