Generate cryptographically random secrets for API keys, password salts, session tokens, or one-time codes. Uses your browser's secure random generator, and the output never leaves your device.
Why use a cryptographically secure random generator? Regular
Math.random() is not suitable for security – it is predictable if an attacker
knows the seed. This tool uses crypto.getRandomValues(), which draws entropy
from the operating system's secure random source (e.g. /dev/urandom on Linux).
The same source is used by password managers, SSH keys, and TLS certificates.
What makes a good secret? Entropy is measured in bits – each character from a 64-character set (lowercase + uppercase + digits) adds ~6 bits of entropy. A 32-character secret with mixed case and digits provides ~190 bits, which is well beyond what any current hardware can brute-force. The best practice is: use a length of 32–64 characters, include lowercase, uppercase, and digits, and add symbols when the service accepts them. Never generate secrets with predictable patterns, timestamps, or dictionary words.