How to Generate Secure Keys

Problem

You need a cryptographic key but want to ensure it is generated with sufficient entropy and the correct size.

Prerequisites

• Understanding of cryptographic randomness
• Knowledge of key sizes for target algorithm

Steps

1. 1. Choose the key type and size

   For AES, choose 128, 192, or 256 bits. For RSA, choose at least 2048 bits (3072+ recommended). For HMAC, the key should be at least as long as the hash output. Match the key size to your security requirements.

   Input

   AES-256

   Output

   32 bytes (256 bits)

2. 2. Use a cryptographically secure RNG

   Generate the key using a cryptographically secure random number generator (CSPRNG). In browsers, use crypto.getRandomValues. In Node.js, use crypto.randomBytes. Never use Math.random or other non-secure PRNGs for keys.

   Input

   crypto.randomBytes(32)

   Output

   32 secure random bytes

3. 3. Store the key securely

   Store the key in a secure key store, environment variable, or hardware security module. Never commit keys to source control. If deriving from a password, use a KDF like PBKDF2 or scrypt with a high iteration count and a random salt.

   Input

   key + secure storage

   Output

   key available at runtime, not in code

Expected result

A cryptographically random key of the correct size, stored securely and never exposed in source code.

Common errors

Using Math.random for key generation

Math.random is not cryptographically secure. Always use crypto.getRandomValues or crypto.randomBytes.

Deriving a key with a single hash of a password

Use a proper KDF (PBKDF2, scrypt, or Argon2) with a high iteration count and a random salt to resist brute force.

Troubleshooting

• If keys are predictable, verify the RNG source is a CSPRNG and not seeded with a known value.
• Check that the key length matches the algorithm requirement exactly.

Security limits

• Keys generated on this tool stay in your browser. No key material is transmitted or stored remotely.