Developer secrets

These generators produce values for applications: signing keys, API keys, tokens, salts and session IDs. Sizes follow the algorithm that will consume them unless you override the size explicitly.

jwt-secret#

A signing secret sized for HS256, HS384 or HS512. The default is HS256 and base64url output.

mint jwt-secret [--algo hs256|hs384|hs512] [--format base64url]

Flag	Effect
`--algo <hs256\|hs384\|hs512>`	Key size: 32, 48 or 64 bytes
`--format <name>`	`hex`, `base64`, `base64url`, `base32`, `base58`, `crockford` or `binary`
`--upper`	Uppercase output
`-l, --length <n>`	Exact output character count
`--size <n>`	Alias for `--length`
`-b, --bytes <n>`	Explicit byte count
`--bits <n>`	Explicit bit count

The algorithm sets the default size. --bytes, --bits or --length override it. RFC 7518 requires a key at least as long as the hash output.

$ mint jwt-secret --algo hs512
dW3tvSGlMmeh_QbURurN7rqPTkSf3WKh_0BfKbWFUuGAB7SOQCdqA6drkbQOrXZMUYvyuYjA2rBVBx-TEayExQ

$ mint jwt-secret --algo hs256 --env JWT_SECRET
JWT_SECRET=<redacted>

apikey#

An API key with a prefix and an optional checksum.

mint apikey [--prefix sk_live_] [--length 32] [--checksum]

Flag	Effect
`--prefix <str>`	Prefix, default `sk_live_`
`-l, --length <n>`	Body length, minimum 8, default 32
`--size <n>`	Alias for `--length`
`-b, --bytes <n>`	Request entropy; the shortest matching body length is used
`--bits <n>`	Request entropy in bits
`--checksum`	Append a 6-character Crockford base32 SHA-256 digest
`--alphabet <chars>`	Custom body alphabet
`--exclude <chars>`	Remove characters from the default alphabet

The default body alphabet is 62 alphanumeric characters. The checksum catches typos and truncated keys before they reach a server.

$ mint apikey --prefix sk_live_ --length 24 --checksum
sk_live_BAkCh...ACTE

$ mint apikey --prefix pk_test_ --length 16
pk_test_...

Samples are redacted here. The command prints the full key to stdout.

token#

A generic URL-safe bearer token. Default: 32 random bytes, base64url encoded.

mint token [--bytes 32] [--format base64url]

Flag	Effect
`--format <name>`	Output encoding
`--upper`	Uppercase output
`-l, --length <n>`	Exact output character count
`--size <n>`	Alias for `--length`
`-b, --bytes <n>`	Bytes of entropy
`--bits <n>`	Bits of entropy

$ mint token --bytes 16
kZGXmckPRMI68kk82oTP0A

hmac#

An HMAC key sized for SHA-256, SHA-384 or SHA-512. The default is SHA-256 with hex output.

mint hmac [--algo sha256|sha512] [--format hex]

Flag	Effect
`--algo <sha256\|sha384\|sha512>`	Key size: 32, 48 or 64 bytes
`--format <name>`	Output encoding
`--upper`	Uppercase output
`-l, --length <n>`	Exact output character count
`-b, --bytes <n>`	Explicit byte count
`--bits <n>`	Explicit bit count

$ mint hmac --algo sha512
58ade3f7dac936dc3556afe741be9a20f5b6e62e8a3908a7ee7a5c8f41a306ad...

aes#

An AES key with an optional IV. AES key sizes are 128, 192 or 256 bits; the default is 256 bits and hex output.

mint aes [--bits 256] [--iv] [--format hex]

Flag	Effect
`--bits <128\|192\|256>`	AES key size
`-b, --bytes <16\|24\|32>`	AES key size in bytes
`--iv`	Generate a 16-byte IV and print `key:iv`
`--format <name>`	Output encoding
`--upper`	Uppercase output
`-l, --length <n>`	Character count instead of an AES key size

When --iv is used, the key and IV are joined with a colon. A colon cannot appear inside any of the output encodings, so splitting is unambiguous. In a normal AES key mode the IV is 16 bytes; with --length, the IV is 16 characters sampled from the chosen alphabet.

$ mint aes --bits 256 --iv
297ac2cbd70f34496ed5a42043797bc8c780f264b422f61bba2874c7b8801e3b:1d1e4a9210f51c579b088cd4f898f141

salt#

A random salt for password hashing. The default is 16 bytes in hex.

mint salt [--bytes 16] [--format hex]

Flag	Effect
`-l, --length <n>`	Exact output character count
`-b, --bytes <n>`	Bytes of entropy
`--bits <n>`	Bits of entropy
`--format <name>`	Output encoding
`--upper`	Uppercase output

$ mint salt
9175661163defd51c38f49f8057446b4

session#

A 256-bit session ID in URL-safe base64.

mint session [--bytes 32]

Flag	Effect
`-l, --length <n>`	Exact output character count
`-b, --bytes <n>`	Bytes of entropy
`--bits <n>`	Bits of entropy
`--format <name>`	Output encoding
`--upper`	Uppercase output

$ mint session
FMbZanRO_ZVjSdInNucU8l5IKtdUfovZadFfFtzKkLA

webhook-secret#

A webhook signing secret with a whsec_ prefix.

mint webhook-secret [--bytes 32]

Flag	Effect
`--prefix <str>`	Override the `whsec_` prefix
`-l, --length <n>`	Exact output character count
`-b, --bytes <n>`	Bytes of entropy
`--bits <n>`	Bits of entropy
`--format <name>`	Output encoding
`--upper`	Uppercase output

The prefix is part of the secret and is included in the printed value. It is not counted in the reported entropy bits.

$ mint webhook-secret
whsec_fIQ2NmxDCmHfVfjL0p4sLNgrHN37EsjUGghMuGamb1U=