How to generate an AES key in Go

Generate a cryptographically random AES key in Go for encrypting data at rest or in transit. Use the browser AES Key Generator to create AES-128/192/256 keys as hex or Base64, then encrypt with crypto/aes GCM (prefer AES-GCM). AES keys are not JWT signing secrets — use the JWT Secret Generator for HS256.

Last updated August 26, 2026

Steps

  1. 1

    Open the AES Key Generator and select AES-256 (recommended for new apps).

  2. 2

    Generate and copy the hex or Base64 key — all randomness stays in your browser.

  3. 3

    In Go, load that key (or create one with crypto/aes GCM) and encrypt with an AEAD mode such as AES-256-GCM.

  4. 4

    Persist the key in a secrets manager; never hardcode it in source or mobile apps.

  5. 5

    Rotate keys on a schedule and keep nonces/IVs unique per encryption.

Code Example

Go
import (
    "crypto/aes"
    "crypto/cipher"
    "crypto/rand"
)

key := make([]byte, 32) // AES-256
if _, err := rand.Read(key); err != nil { panic(err) }
block, err := aes.NewCipher(key)
if err != nil { panic(err) }
aesGCM, err := cipher.NewGCM(block)
if err != nil { panic(err) }
nonce := make([]byte, aesGCM.NonceSize())
if _, err := rand.Read(nonce); err != nil { panic(err) }
ciphertext := aesGCM.Seal(nil, nonce, []byte("secret data"), nil)
_ = ciphertext
Open AES Key Generator

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Generate Api Key Best PracticesHow To Store Jwt Secrets Securely

Frequently Asked Questions

Which AES key size should I use?

AES-256 is recommended for new systems. AES-128 remains secure for many workloads, but 256-bit gives a larger long-term margin.

How do I encrypt with an AES key in Go?

Use crypto/aes GCM with an AEAD mode (AES-GCM). Generate a fresh nonce/IV per message, keep the key secret, and authenticate associated data when your protocol needs it.

Is AES the same as JWT signing?

No. JWT HS256/RS256 signs tokens; AES encrypts payloads or stored data. Encrypted JWTs use JWE, which is a separate format from typical signed JWTs.

Hex or Base64 for storing AES keys?

Either works. Hex is easy to diff in configs; Base64 is more compact. Prefer a secrets manager over plain env files when possible.