Preshared Key Generator

Learn about preshared keys

What makes a key "cryptographically random"

This generator draws its bytes from the Web Crypto API's crypto.getRandomValues(), which pulls from your operating system's cryptographically secure random number generator. That matters because JavaScript's ordinary Math.random() is explicitly not designed to be unpredictable. It's fine for shuffling a game board, but not for anything a security decision will rest on, since its output can in some cases be predicted.

Choosing a length and format

More bytes means more entropy and more resistance to brute-force guessing. 256-bit (32 bytes) is a common baseline for IPsec and VPN tunnel secrets, with 384- or 512-bit available for stricter requirements. If you're generating a key for WireGuard's optional PresharedKey field specifically, use 256-bit and Base64 output. That field is defined as exactly 32 random bytes, base64-encoded, with no special elliptic-curve math involved (unlike WireGuard's actual identity keypairs, which are Curve25519 keys and aren't just arbitrary random bytes).

Common questions

Which output format should I use? Use whatever the config file you're pasting into expects. Base64 and hex both encode the exact same amount of entropy for a given byte length, just written differently. Alphanumeric is there for systems that reject punctuation-heavy strings.

Is a longer key always better? Beyond a certain point, no. 256 bits already represents more possible combinations than there are atoms on Earth. Match the length your target system expects rather than maximizing it by default.

Can I reuse the same key across multiple tunnels? Best practice is a unique key per tunnel or peer pair. Reusing one key everywhere means a single leak compromises every connection that shares it, instead of just one.