AES Key Generator

What this tool does

It generates a cryptographically random AES encryption key — 128, 192, or 256 bits — and formats it as hex or Base64, ready to paste into a config file, environment variable, or crypto library call.

What is an AES key?

AES (Advanced Encryption Standard) is a symmetric-key cipher: the same key both encrypts and decrypts data. The key itself is nothing more than a fixed-length string of random bits — 16 bytes for AES-128, 24 for AES-192, or 32 for AES-256. Anyone who obtains the key can read anything encrypted with it, so the only thing that makes a key secure is that it's unpredictable and kept secret. That's why this generator draws its bytes from crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator — not Math.random(), which is fast but predictable and unsuitable for anything security-related.

128-bit vs 256-bit: which should you pick?

AES-128 is already infeasible to brute-force with any known or foreseeable technology, and it runs slightly faster, particularly on hardware without AES-NI acceleration. It's a reasonable default for most applications.

AES-256 gives a larger security margin — useful for long-lived data, compliance requirements (some standards mandate 256-bit keys), or defense against future advances in cryptanalysis, including theoretical attacks from large-scale quantum computers. The performance difference versus AES-128 is negligible on modern CPUs.

AES-192 sits between the two and is rarely required by any specific standard; most projects choose 128 or 256.

How to use it

1. Choose a key size (128, 192, or 256-bit).
2. Choose an output format — hex (uppercase) or Base64, whichever your library or config format expects.
3. Click Generate key.
4. Copy the key with the copy button.

Click Generate again any time you need a fresh key — each click draws new random bytes.

FAQ

Does this generate an IV (initialization vector) too? No — this tool outputs the key only. Most AES modes (GCM, CBC) also require a random, unique IV per encryption operation, generated separately at encryption time; reusing an IV with the same key can leak information, so it generally shouldn't be pre-generated and stored alongside the key.

Which format should I use, hex or Base64? Either is a full-fidelity encoding of the same bytes. Hex is easier to read and debug; Base64 is roughly 25% shorter, which some config formats or environment-variable size limits prefer.

Is this key secure enough for production? Yes — the underlying randomness source is the same CSPRNG your operating system and browser use for TLS and other security-critical operations. The strength of your system still depends on keeping the key secret and rotating it appropriately.

Privacy

The key is generated entirely in your browser using the Web Crypto API. It is never sent to our servers, logged, or stored anywhere — closing or reloading the page discards it permanently, so save it somewhere secure before you navigate away.