Base64 Secret Generator

What is a Base64 Secret?

A Base64 secret is a cryptographically secure key that has been encoded using Base64 encoding. Base64 converts binary data into ASCII text using 64 printable characters (A-Z, a-z, 0-9, +, /). This encoding makes secrets safe to use in URLs, JSON, XML, and other text-based formats where special characters might cause issues.

Our Base64 secret generator first creates a cryptographically random key, then encodes it in Base64 format. This ensures your Base64 secret is both secure (truly random) and portable (safe for any text-based system). Base64 secrets are commonly used for API keys, bearer tokens, session identifiers, and encryption keys in configuration files.

Why Use Base64 Encoding for Secrets?

Common Base64 Secret Use Cases

• →
  Bearer Tokens: OAuth 2.0 and many API authentication systems use Base64 secrets as bearer tokens in Authorization headers.
• →
  Environment Variables: Base64 secrets work perfectly in .env files and environment variable systems without escaping issues.
• →
  JWT Secrets: Many JWT libraries expect Base64-encoded secrets for HMAC signing (HS256, HS384, HS512).
• →
  Configuration Files: Store Base64 secrets in JSON, YAML, or XML config files without special character concerns.
• →
  Database Keys: Base64 secrets can be stored as TEXT fields in databases, avoiding BLOB or BINARY column types.

How to Use This Base64 Secret Generator

1. 1
   Select byte length Common choices: 16 bytes (22 chars), 24 bytes (32 chars), 32 bytes (44 chars), or 48 bytes (64 chars).
2. 2
   Generate your Base64 secret The output will be Base64-encoded automatically using cryptographically secure randomness.
3. 3
   Copy and use For URLs, consider using Base64URL encoding (replaces + with -, / with _, removes = padding).

Working with Base64 Secrets

Here's how to generate, encode, and decode Base64 secrets in different languages:

const crypto = require('crypto');

// Generate Base64 secret
const secret = crypto.randomBytes(32).toString('base64');
console.log('Base64 secret:', secret);

// Generate Base64URL secret (URL-safe)
const urlSafeSecret = crypto.randomBytes(32)
  .toString('base64')
  .replace(/\+/g, '-')
  .replace(/\//g, '_')
  .replace(/=/g, '');
console.log('Base64URL secret:', urlSafeSecret);

// Decode Base64 secret
const decoded = Buffer.from(secret, 'base64');
console.log('Decoded bytes:', decoded.length);

import base64
import secrets

# Generate Base64 secret
secret_bytes = secrets.token_bytes(32)
secret = base64.b64encode(secret_bytes).decode('utf-8')
print(f'Base64 secret: {secret}')

# Generate Base64URL secret
url_safe_secret = base64.urlsafe_b64encode(secret_bytes).decode('utf-8').rstrip('=')
print(f'Base64URL secret: {url_safe_secret}')

# Decode Base64 secret
decoded = base64.b64decode(secret)
print(f'Decoded bytes: {len(decoded)}')

Base64 vs Base64URL Encoding

Base64 Secret Best Practices

• Use sufficient entropy: Generate at least 16-32 bytes of random data before Base64 encoding for adequate security.
• Choose the right variant: Use Base64URL for URLs, JWT tokens, and filenames. Use standard Base64 for config files and general storage.
• Don't decode unnecessarily: Many systems can work directly with Base64 secrets without decoding them first.
• Store securely: Base64 encoding doesn't encrypt data—it just encodes. Base64 secrets still need secure storage like environment variables.
• Validate format: When accepting Base64 secrets as input, validate they're properly formatted before using them.
• Be aware of size increase: Base64 encoding increases size by ~33%. A 24-byte secret becomes 32 Base64 characters.

Base64 Secret Generator FAQ

Related Secret Generators

Resource Hub