Pick what the secret is for, press generate, and copy it. Every value is built from your browser's cryptographically secure random source, in the format and length that use case expects — a 256-bit hex string for a cron secret, a long base64url string for a JWT signing key, a 50-character key for Django.
A secret key only protects anything if an attacker cannot guess it, and that means it has to be long and genuinely random — not a word, not a pattern, and not something typed by hand. The presets here follow common practice: cron and generic secrets are 32 random bytes (256 bits) written as 64 hex characters, JWT secrets are 64 random bytes (512 bits) in URL-safe base64, webhook secrets are 32 random bytes in base64, Django keys use the same 50-character alphabet Django's own tool draws from, and API keys are a short prefix plus 40 random letters and digits.
Cron job secrets. Scheduled jobs are often triggered by an HTTP request to an endpoint on your own app. Without protection, anyone who finds the URL can trigger the job. The usual fix is a shared secret stored in an environment variable — commonly called CRON_SECRET — that the scheduler sends along (for example in an Authorization: Bearer header) and your endpoint checks before doing anything. Some hosting platforms, such as Vercel, support exactly this pattern for their cron jobs. Turn on Output as .env line to get a ready-to-paste CRON_SECRET=… line.
A note on trust. This page generates everything locally in your browser and sends nothing anywhere. Even so, for your most sensitive production secrets, the safest habit is to generate them on a machine you control. One command does it: openssl rand -hex 32, or in Node node -e "console.log(require('crypto').randomBytes(32).toString('hex'))", or in Python python3 -c "import secrets; print(secrets.token_hex(32))".
Frequently asked questions
How long should a secret key be?
At least 128 bits for anything modest, and 256 bits (32 random bytes) as a strong default. The cron, generic, Flask, and webhook presets use 256 bits; the JWT preset uses 512 bits, which comfortably exceeds the minimum for HS256.
What's the difference between hex, base64, and base64url?
They are just different ways to write the same random bytes. Hex uses 0–9 and a–f and is easy to read and paste anywhere. Base64 packs the same bytes into fewer characters but includes +, /, and =. Base64url swaps those for - and _ so the value is safe inside URLs and tokens.
How do I protect a cron job endpoint?
Store a random secret in an environment variable, have the scheduler send it with each request, and reject any request that does not carry it. Compare the values with a constant-time comparison where your language offers one, and never log the secret.
Is it safe to generate secrets on a website?
This tool runs entirely in your browser using the Web Crypto API and does not transmit or store what it creates. For high-value production secrets, generating them locally with openssl or your language's crypto library is the more conservative habit, and the commands are listed above.
How is this different from the random hash generator?
The hash generator produces random hex strings in common hash lengths for test data and placeholders. This tool is built for real secrets: it uses preset lengths and formats for specific jobs, and can output a ready-to-use environment variable line.
Can I reuse one secret across projects?
You shouldn't. Give each service and environment its own secret so that a leak in one place can be rotated without breaking everything else.