Is this a password generator?

No. It generates an AES-256 encryption key (32 random bytes) and a matching IV meant to encrypt one specific secret value, along with the exact commands to do so, not a human-memorable password. For generating passwords, use the dedicated Password Generator tool instead.

Why AES-256-CBC specifically?

CBC mode is universally supported by openssl's `enc` command, Node's `crypto` module, and .NET's `Aes` class without extra libraries or authenticated-encryption bookkeeping, making it the most portable choice for a copy-paste command-line workflow across three different environments.

Do I need to keep the same IV for every value I encrypt with this key?

No, and you shouldn't. Each generation here produces one key and one IV together as a matched example set. In real use, reuse the key across multiple secrets if you want, but generate a fresh random IV for every individual encryption operation, reusing an IV with the same key weakens CBC mode's security guarantees.

Where should I actually store the generated key?

Not in the same repository or environment as the encrypted value; that defeats the purpose. Common options are a secrets manager (AWS Secrets Manager, HashiCorp Vault), a CI/CD platform's encrypted secrets store, or a hardware security module for high-sensitivity keys.

Environment Variable Encryptor - AES-256 Key + Decrypt Commands

Overview

Introduction

Encrypting a single sensitive environment variable value, an API key, a database password, a signing secret, before it touches version control or a CI log is good practice, but assembling a correct key, IV, and matching commands across openssl, Node, and PowerShell by hand is tedious and error-prone.

This tool generates that key/IV pair with the browser's native Web Crypto API and produces ready-to-run commands for all three environments, scoped explicitly to protecting one named variable's value.

What Is Environment Variable Encryptor?

A generator for a random AES-256 key and 128-bit IV via `crypto.subtle.generateKey()`, exported in both hex and base64, framed around encrypting and decrypting one specific environment variable's secret value.

Alongside the key material, it produces matching command templates: an openssl `enc` encrypt/decrypt pair, a Node.js `crypto` decrypt snippet, and a PowerShell `Aes` class decrypt snippet, all pre-filled with the generated key and IV.

How Environment Variable Encryptor Works

A 256-bit AES-CBC key is generated via the Web Crypto API and exported as raw bytes, then encoded to both hex and base64; a separate 128-bit IV is generated with `crypto.getRandomValues()`.

Those two values are substituted directly into command templates for openssl (`-K`/`-iv` hex flags), Node.js (`Buffer.from(hex, 'hex')` plus `createDecipheriv`), and PowerShell (`[System.Convert]::FromHexString` plus the `Aes` class), so every command is immediately runnable against a file encrypted with this exact key/IV pair.

When To Use Environment Variable Encryptor

Use it when you need to encrypt one sensitive value (an API key, a database credential) before committing it to a config file, CI variable, or shared document.

It's also useful as a quick reference for the exact command-line syntax to decrypt an AES-256-CBC value in whichever of openssl, Node, or PowerShell your deployment environment uses.

Often used alongside Secrets Manager Config Generator and .env File Generator.

Features

Advantages

Uses the browser's native Web Crypto implementation to generate the key, not a JavaScript reimplementation of AES key generation.
Produces matching, ready-to-run commands across three different environments (openssl, Node.js, PowerShell) from the same key/IV pair.
Framed narrowly around one variable's value, keeping the workflow simple rather than trying to be a general encryption tool.

Limitations

Generates the key/IV pair only; it doesn't actually encrypt your real secret value in the browser (the commands operate on your local machine or CI environment where the real value lives).
Uses CBC mode for cross-tool portability, not an authenticated mode like GCM; CBC alone doesn't detect tampering with the ciphertext.

Examples

Generating a key/IV pair for DATABASE_PASSWORD

Input

variableName: DATABASE_PASSWORD, keyEncoding: hex

Output

Key (hex): 9f2c... (64 hex characters)
IV (hex): 3a71... (32 hex characters)

# --- Encrypt the secret value with openssl ---
echo -n "the-real-secret-value" | openssl enc -aes-256-cbc -K 9f2c... -iv 3a71... -out database_password.enc

The generated key and IV populate every command template, so they're immediately runnable against the real secret value on your own machine.

Best Practices & Notes

Best Practices

Store the generated key in a secrets manager or your CI platform's encrypted secret store, never alongside the encrypted value itself.
Generate a fresh IV for every value you encrypt with a given key, even though this tool pairs one key with one IV per generation for the example commands.
Rotate the key periodically and whenever anyone with access to it leaves the project or team.

Developer Notes

Key generation uses `crypto.subtle.generateKey({ name: "AES-CBC", length: 256 }, true, ["encrypt", "decrypt"])` followed by `exportKey("raw", key)` to get the raw 32-byte key material; the IV is 16 random bytes from `crypto.getRandomValues()`, matching AES's 128-bit block size. Hex encoding is a manual byte-to-two-hex-digit loop; base64 encoding goes through `btoa` over the raw byte string, both to avoid pulling in a Buffer polyfill in a browser context.

Environment Variable Encryptor Use Cases

Generating a key to encrypt a database password or API key before committing an encrypted version to a repository
Producing copy-paste-ready decrypt commands for whichever tool a CI pipeline or deployment target actually has installed
Quickly refreshing (rotating) the key used to encrypt a specific sensitive configuration value

Common Mistakes

Reusing the same IV across multiple different encryption operations with the same key, which weakens CBC mode's confidentiality guarantees.
Storing the generated key in the same place (repo, config file) as the value it encrypts, which defeats the purpose of encrypting it at all.

Tips

Follow up with the Secrets Manager Config Generator once you've decided where the encrypted value (or, more commonly, the plaintext managed by that service) should actually live long-term.

Environment Variable Encryptor