Which AES key size should I use?

AES-256 is recommended for new applications. AES-128 is still secure but 256-bit provides a larger margin for long-term data protection.

Is AES the same as JWT encryption?

No. JWTs are typically signed (JWS) not encrypted. AES encrypts data at rest or in transit. JWE uses encryption for JWT payloads.

Hex or Base64 for storage?

Either works. Hex is common in config files. Base64 is more compact. Store in environment variables or a secrets manager.

Tool

AES Key Generator

Generate AES-128, AES-192, and AES-256 keys as hex or Base64.

Last updated April 1, 2026

Runs entirely in your browser — no data sent to servers. Privacy policy

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

Key size

Click "Generate AES key" to create hex and Base64 key material in your browser.

AES keys are generated with crypto.getRandomValues via Web Crypto. Store keys in a secrets manager, never in source code.

Select AES key size: 128, 192, or 256 bits. AES-256 is recommended for new applications.

Click Generate to create a cryptographically random key using Web Crypto.

Copy the hex or Base64 output for use in your encryption library.

Store keys in a secrets manager. Never hardcode AES keys in source code.

const crypto = require('crypto');
const key = crypto.randomBytes(32); // 256-bit AES key
const iv = crypto.randomBytes(12);
const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
let encrypted = cipher.update('secret data', 'utf8', 'hex');
encrypted += cipher.final('hex');

const crypto = require('crypto');
const key = crypto.randomBytes(32); // 256-bit AES key
const iv = crypto.randomBytes(12);
const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
let encrypted = cipher.update('secret data', 'utf8', 'hex');
encrypted += cipher.final('hex');

from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import os
key = os.urandom(32)  # 256-bit
nonce = os.urandom(12)
aesgcm = AESGCM(key)
ciphertext = aesgcm.encrypt(nonce, b'secret data', None)

import "crypto/aes"
import "crypto/cipher"
import "crypto/rand"
key := make([]byte, 32)
rand.Read(key)
block, _ := aes.NewCipher(key)
aesGCM, _ := cipher.NewGCM(block)

Continue learning

ToolsHash GeneratorBase64 Encoder

GuidesNode.jsPythonGoJavaRuby

ArticlesAES-256 Key Generation GuideHow to Store JWT Secrets SecurelyJWT Best Practices Checklist

How to Use This Tool

Continue learning