How to generate an AES key in Python

Generate a cryptographically random AES key in Python for encrypting data at rest or in transit. Use the browser AES Key Generator to create AES-128/192/256 keys as hex or Base64, then encrypt with cryptography AESGCM (prefer AES-GCM). AES keys are not JWT signing secrets — use the JWT Secret Generator for HS256.

Last updated August 26, 2026

Steps

  1. 1

    Open the AES Key Generator and select AES-256 (recommended for new apps).

  2. 2

    Generate and copy the hex or Base64 key — all randomness stays in your browser.

  3. 3

    In Python, load that key (or create one with cryptography AESGCM) and encrypt with an AEAD mode such as AES-256-GCM.

  4. 4

    Persist the key in a secrets manager; never hardcode it in source or mobile apps.

  5. 5

    Rotate keys on a schedule and keep nonces/IVs unique per encryption.

Code Example

Python
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os

key = os.urandom(32)  # AES-256
nonce = os.urandom(12)
aesgcm = AESGCM(key)
ciphertext = aesgcm.encrypt(nonce, b"secret data", None)

# Or bytes.fromhex(...) / base64.b64decode(...) a key from the browser tool.
print(key.hex(), nonce.hex(), ciphertext.hex())
Open AES Key Generator

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Generate Api Key Best PracticesHow To Store Jwt Secrets Securely

Frequently Asked Questions

Which AES key size should I use?

AES-256 is recommended for new systems. AES-128 remains secure for many workloads, but 256-bit gives a larger long-term margin.

How do I encrypt with an AES key in Python?

Use cryptography AESGCM with an AEAD mode (AES-GCM). Generate a fresh nonce/IV per message, keep the key secret, and authenticate associated data when your protocol needs it.

Is AES the same as JWT signing?

No. JWT HS256/RS256 signs tokens; AES encrypts payloads or stored data. Encrypted JWTs use JWE, which is a separate format from typical signed JWTs.

Hex or Base64 for storing AES keys?

Either works. Hex is easy to diff in configs; Base64 is more compact. Prefer a secrets manager over plain env files when possible.