How to generate an AES key in Node.js

Generate a cryptographically random AES key in Node.js for encrypting data at rest or in transit. Use the browser AES Key Generator to create AES-128/192/256 keys as hex or Base64, then encrypt with Node crypto (aes-256-gcm) (prefer AES-GCM). AES keys are not JWT signing secrets — use the JWT Secret Generator for HS256.

Last updated August 26, 2026

Steps

  1. 1

    Open the AES Key Generator and select AES-256 (recommended for new apps).

  2. 2

    Generate and copy the hex or Base64 key — all randomness stays in your browser.

  3. 3

    In Node.js, load that key (or create one with Node crypto (aes-256-gcm)) and encrypt with an AEAD mode such as AES-256-GCM.

  4. 4

    Persist the key in a secrets manager; never hardcode it in source or mobile apps.

  5. 5

    Rotate keys on a schedule and keep nonces/IVs unique per encryption.

Code Example

Node.js
const crypto = require('crypto');

const key = crypto.randomBytes(32); // AES-256
const iv = crypto.randomBytes(12);
const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
let encrypted = cipher.update('secret data', 'utf8', 'hex');
encrypted += cipher.final('hex');
const tag = cipher.getAuthTag().toString('hex');

// Or decode a hex/Base64 key copied from the browser AES Key Generator.
console.log({ key: key.toString('hex'), iv: iv.toString('hex'), encrypted, tag });
Open AES Key Generator

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Generate Api Key Best PracticesHow To Store Jwt Secrets Securely

Frequently Asked Questions

Which AES key size should I use?

AES-256 is recommended for new systems. AES-128 remains secure for many workloads, but 256-bit gives a larger long-term margin.

How do I encrypt with an AES key in Node.js?

Use Node crypto (aes-256-gcm) with an AEAD mode (AES-GCM). Generate a fresh nonce/IV per message, keep the key secret, and authenticate associated data when your protocol needs it.

Is AES the same as JWT signing?

No. JWT HS256/RS256 signs tokens; AES encrypts payloads or stored data. Encrypted JWTs use JWE, which is a separate format from typical signed JWTs.

Hex or Base64 for storing AES keys?

Either works. Hex is easy to diff in configs; Base64 is more compact. Prefer a secrets manager over plain env files when possible.