Help & guide
RandKeyKit creates strong, random keys, passwords, and tokens right on your device. Here is what each tool is for, how to use it, and why your secrets stay private.
What is RandKeyKit?
A simple toolkit for generating the secrets you need every day — passwords, passphrases, API keys, and more. Every value is created with your browser's built-in secure random generator, so the results are genuinely unpredictable and safe to use. Open the generator to get started.
Your privacy
- Nothing is sent anywhere. Everything is generated on your own device. No accounts, no tracking, no servers involved.
- Nothing is saved. Your generated values are never stored. Close or refresh the page and they are gone for good.
- Works offline. Once the page has loaded, you can disconnect from the internet and it keeps working.
How to use it
- 1Pick a tool. Use the sidebar categories or scroll the cards to find what you need.
- 2Adjust the options. Set the length and format. The defaults are already secure, so you can leave them as they are.
- 3Generate. Click Generate to create a fresh value. Click it again any time for a new one.
- 4Copy it. Use the copy button next to the result, then paste it where you need it.
The Refresh All button at the top regenerates every tool at once.
What each tool is for
Passcodes
| Tool | What it's for |
|---|---|
| Password | A strong password for any account. Mixes letters, digits, and symbols for maximum entropy. Use the longest length the service allows — 12+ characters is the minimum, 16+ for anything sensitive. |
| Passphrase | A password made of random words joined together — easier to remember and type by hand. Slightly lower character-density entropy, but much less error-prone when you have to enter it manually. |
| TOTP Secret | A Base32-encoded secret that seeds a time-based one-time password (TOTP) app such as Google Authenticator or Authy. Compatible with RFC 6238. Scan the QR code to register it in your authenticator app. |
Tokens
| Tool | What it's for |
|---|---|
| API Key | A random string to authenticate API clients. Treat it like a password — store it in a secrets manager, never commit it to source control. 48+ characters is recommended for production use. |
| Session Token | An opaque random token for identifying a signed-in session. Store it server-side (or in a secure, HttpOnly cookie), and always transmit it over HTTPS. 32+ bytes of entropy is the minimum. |
| CSRF Token | A per-session random value embedded in web forms to prevent cross-site request forgery attacks. The server generates it, embeds it in the HTML, and validates it on every state-changing request. |
| UUID | A universally unique identifier following RFC 9562 (UUIDv4). Useful for database primary keys, correlation IDs, request tracing, and anywhere you need a globally unique string without a central coordinator. |
| JWT Secret | An HMAC signing secret shared between the JWT issuer and verifier. Used for HS256, HS384, and HS512 algorithms. Should be at least 256 bits — longer is better and has no practical downside. |
Keys
| Tool | What it's for |
|---|---|
| Salt | A random byte sequence used when hashing passwords with bcrypt, scrypt, or Argon2. The salt ensures two users with the same password produce different hashes. Use 16+ bytes — most libraries handle this for you automatically. |
| AES Key | A symmetric key for AES-GCM encryption. Use 256-bit (the default) for all new applications. Symmetric means the same key encrypts and decrypts — keep it secret and never embed it in client-side code. |
| HMAC Key | A secret key for computing HMAC-SHA-256 message authentication codes. Used to sign data payloads and verify they have not been tampered with in transit. 256+ bits gives you a security margin that matches the hash output. |
| RSA Keypair | An asymmetric encryption and signing keypair exported as standard PEM files (SPKI for the public key, PKCS#8 for the private key). RSA-4096 is available for long-term key material. Use the public key to encrypt or verify; keep the private key offline. |
| ECDSA Keypair | An elliptic-curve signing keypair (P-256 or P-384) exported in PKCS#8 + SPKI PEM format. Smaller keys and faster operations than RSA, with equivalent security. Suitable for TLS certificates, code signing, and JWTs using ES256/ES384. |
| Ed25519 Keypair | A modern, high-performance signing keypair based on the Edwards-curve Digital Signature Algorithm. Fast, compact, and resistant to several classes of implementation errors. Exported as standard PEM files. A solid default for new signing use-cases. |
Not sure which one you need? For everyday logins, use Password or Passphrase. The rest are building blocks for apps and websites. Try them all in the generator.
Features
- Batch generation. Use the COUNT control to generate up to 100 values in a single click. All of them stack in the output area and export together.
- Export. Download results as TXT (one value per line), CSV (with headers), or ENV (KEY=value format) via the Export menu. Everything is assembled locally — no upload, no server.
- Copy + auto-clear clipboard. One click copies the value. The clipboard is automatically cleared after a configurable delay so sensitive values don't linger.
- Show / hide value. A toggle masks the generated value so it doesn't show on screen — useful when working in a shared space or screen-sharing.
-
QR code. For short values, a "Show QR" button renders a scannable QR code on screen. The TOTP Secret generator produces a Google Authenticator–compatible
otpauth://URI. Long values like keypair PEMs do not get a QR button. - Session history. Recent values are kept in memory only for the duration of the session. Reloading the page clears everything — nothing is written to localStorage, IndexedDB, or cookies.
- Works offline (PWA). A service worker caches the app shell on the first visit. After that, the tool works identically with no internet connection.
- PEM output for keypairs. RSA, ECDSA, and Ed25519 generators export standard PEM-encoded keys (SPKI for public, PKCS#8 for private), displayed in a scrollable output area so you can review them before copying.
Tips for strong secrets
- Longer is stronger. When in doubt, increase the length.
- Never reuse the same password across sites.
- Save it in a password manager right after generating — these values are not stored here.
- Generate a fresh value for each new account or service.
Frequently asked questions
Is my data sent to a server?
No — everything runs in your browser. No network requests are made after the page loads. All generation uses the browser's built-in Web Crypto API.
Are the generated values cryptographically secure?
Yes. RandKeyKit uses crypto.getRandomValues, the browser's CSPRNG (Cryptographically Secure Pseudo-Random Number Generator), for all output.
Does it work offline?
Yes — after the first visit, a service worker caches the app shell. You can open it with no internet connection and it works exactly the same.
Are generated values stored anywhere?
No. Values only exist in memory while the page is open. Closing or reloading the tab clears everything — nothing is written to localStorage, IndexedDB, or cookies.
Can I generate many values at once?
Yes. Use the COUNT control to generate up to 100 values in a single click. All of them stack in the output area and can be exported together.
How do I export the results?
Click the Export menu and choose TXT (one value per line), CSV (with headers), or ENV (KEY=value format). The file is assembled locally and downloaded directly — no upload.
Which password length should I use?
At least 12 characters for personal accounts, 16+ for anything sensitive. Longer values are exponentially harder to crack, so use the longest length the service allows.
What is a TOTP secret for?
A TOTP secret seeds a time-based one-time password app like Google Authenticator or Authy. The server and the app share the same secret, and both derive the same 6-digit code every 30 seconds.
What is the difference between a Password and a Passphrase?
A Password mixes letters, digits, and symbols — high entropy, hard to memorize. A Passphrase is several random words joined together — slightly lower character entropy but much easier to remember and type correctly.
Can I scan a QR code to set up 2FA?
Yes — for the TOTP Secret generator, a "Show QR" button renders a QR code that encodes a standard otpauth:// URI. Scan it with Google Authenticator, Authy, or any compatible app.