OneTaskBy Tim King · Updated
AES Key Generator
Browser-Generated AES Keys in Hex, Base64 or JWK With Optional GCM Nonce
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the AES Key Generator works
This AES key generator produces random 128, 192 or 256-bit keys for AES encryption, formatted as hex, Base64, Base64url or a JSON Web Key ready for the Web Crypto API. Add a 96-bit nonce for AES-GCM if you need one for testing. Keys come from your browser's cryptographic generator and are never sent anywhere.
What the AES key generator produces
An AES key is simply random bytes: 16 for AES-128, 24 for AES-192 and 32 for AES-256. Any value of the
right length is a valid key, so there is no structure to generate, only good randomness. The page uses
crypto.getRandomValues, which draws from the operating system's secure random source.
Choosing a format
Hex is easiest to read and paste into config files and command-line tools such as openssl enc -K.
Base64 is shorter and common in environment variables. Base64url avoids + and / for URLs and
tokens. The JWK form can be passed straight to crypto.subtle.importKey('jwk', …) in a browser or Node.
Nonces are not keys
AES-GCM needs a 12-byte nonce for each message, and a nonce must never repeat with the same key. The optional nonce here is for trying things out. In real code, generate a new random nonce for every encryption and store it alongside the ciphertext.
FAQ
Should I use AES-128 or AES-256?
Both are unbroken. AES-128 is fast and far beyond brute force. AES-256 adds margin against future attacks, including quantum search, and is required by some compliance rules. Choose 256 unless a system only accepts 128.
Is it safe to generate keys on a web page?
The randomness is the same that native apps use, and nothing is transmitted. For production secrets the safer practice is to generate keys where they will live, such as a key management service, so the key is never on your clipboard. This page suits development, testing and small projects.
Can I turn a password into an AES key?
Not by generating one here. A password must go through a key derivation function such as PBKDF2, scrypt or Argon2 with a salt, which is what the text encryptor does. Using a password's bytes directly as a key makes it easy to guess.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
Random String Generator
Cryptographically random strings in any length and character set.
Text Encryptor
Encrypt and decrypt messages with a passphrase, AES-256-GCM in your browser.
API Key Generator
Random prefixed API keys with an optional checksum, like GitHub tokens.
HMAC-SHA256 Generator
Sign a message with HMAC-SHA256 and verify signatures.
File Encryptor
Password-encrypt any file with AES-256-GCM, without uploading it.