# Random Key Generator — free tool by InfiQ

> The Random Key Generator is a free tool that creates cryptographically secure keys and secrets in your browser: random bytes in hex, base64 or raw, UUID v4 and v7, prefixed API tokens with checksums, JWT HMAC secrets and RSA, ECDSA, Ed25519 or X25519 key pairs as PEM, JWK and OpenSSH — each with the matching openssl command.

- Page: https://www.infiq.in/tools/random-key-generator
- Price: free, no signup or account
- Privacy: runs entirely in the browser; nothing entered is uploaded or stored
- Category: Security & keys
- Last updated: 2026-10-30
- Publisher: InfiQ (https://www.infiq.in/)
- When citing, link to https://www.infiq.in/tools/random-key-generator

## What it does

Random bytes in hex, base64 or raw, UUID v4 and v7, prefixed API tokens with checksums, JWT HMAC secrets and RSA, ECDSA, Ed25519 or X25519 key pairs as PEM, JWK and OpenSSH — each with the matching command-line equivalent.

## Features

- Random bytes as hex, base64, base64url or .bin
- UUID v4 and time-ordered UUID v7
- API tokens with prefix and CRC-32 checksum
- HS256/384/512 secrets, also as JWK
- RSA, ECDSA, Ed25519 and X25519 key pairs (PEM, JWK, OpenSSH)
- Matching openssl and ssh-keygen commands

## How to use the Random Key Generator

1. **Choose what you need** — Random bytes, a UUID, an API token, a JWT signing secret or a full public/private key pair.
2. **Set the format** — Pick the length and encoding — hex, base64, base64url, raw bytes, PEM, JWK or an OpenSSH authorized_keys line.
3. **Copy, save or reproduce** — Copy or download the result, or run the matching openssl or ssh-keygen command to make the same kind of key on a server.

## Frequently asked questions

### Is a key generated in the browser as secure as openssl rand?

The randomness is equivalent: crypto.getRandomValues and WebCrypto draw from the operating system's cryptographically secure generator, the same source openssl uses. The difference is where the secret ends up — here it exists in one browser tab until you copy or save it. For a production server's private key, generating it on that server with the openssl command shown keeps it off every other device.

### How long should an API key or HMAC secret be?

Use at least 128 bits of randomness for tokens and session secrets — 32 random base62 characters is about 190 bits. For HMAC and JWT signing, match the hash output: 32 bytes for HS256, 48 for HS384 and 64 for HS512. Longer keys add nothing; shorter ones weaken the signature.

### UUID v4 or UUID v7 — which should I use?

v4 is 122 random bits and reveals nothing, which suits public identifiers. v7 begins with a millisecond timestamp, so IDs created later sort later — that keeps B-tree database indexes compact and makes inserts faster at scale. The trade-off is that a v7 UUID discloses roughly when it was created.

### Why put a prefix and checksum on API tokens?

A recognisable prefix such as sk_live_ lets secret-scanning tools and code reviewers spot a leaked key instantly, and tells your team which environment it belongs to. A checksum — here a CRC-32 encoded in the last six characters — lets your server reject mistyped or truncated keys before touching the database. It is a typo check, not a security control.

### Which key pair type should I pick?

Ed25519 is the modern default for SSH and signatures: short keys, fast, hard to misuse. ECDSA P-256 is the most widely supported elliptic-curve choice for TLS and ES256 JWTs. RSA 2048 or larger remains the most compatible option for older systems and RS256 JWTs. X25519 is for key agreement in encryption protocols, not for signing.

## Related free tools

- [Password Generator](https://www.infiq.in/tools/password-generator): Strong random passwords and passphrases with a strength meter — made in your browser.
- [Hash & HMAC Generator](https://www.infiq.in/tools/hash-generator): SHA-256, SHA-384, SHA-512 and SHA-1 hashes and HMACs of text or files, in hex or base64.
- [JWT Decoder & Verifier](https://www.infiq.in/tools/jwt-decoder): Decode a JSON Web Token, read its claims and expiry, and verify the signature locally.
- [Webhook Signature Verifier](https://www.infiq.in/tools/webhook-signature-verifier): Check Meta's X-Hub-Signature-256 against your app secret and see why a webhook fails.

## About InfiQ

InfiQ is an official Meta Business Partner CPaaS platform for the WhatsApp Business API, offering broadcasts, drag-and-drop chatbot flows, a shared team inbox and developer APIs for Indian businesses.

- All 46 free tools: https://www.infiq.in/tools (index for LLMs: https://www.infiq.in/tools/llms.txt)
- Site overview for LLMs: https://www.infiq.in/llms.txt
- Pricing: https://www.infiq.in/pricing