How much randomness does an API key need?
Start with random bytes, then choose an encoding. Length and entropy are related, but they are not interchangeable.
Count unpredictable bits, not visible characters
For independent uniformly selected symbols, entropy in bits is length × log2(alphabet size). A uniformly random byte has 256 possible values, or eight bits of entropy. Thirty-two independent random bytes therefore represent 256 bits. Hex writes each byte using two characters, so that same secret becomes a 64-character string. Base64url uses a larger alphabet and writes those bytes more compactly without changing their entropy.
A recognizable prefix can make operations easier: logs can identify the type of a credential without showing its entire value. The prefix itself is predictable and contributes zero entropy. Treat it as a label, and keep the random portion intact.
32 random bytes = 256 bits Hex length = 64 characters Base64url length = 43 characters (unpadded)
Avoid bias when restricting the alphabet
Mapping an arbitrary byte to an alphabet of 62 symbols with value % 62 introduces bias because 256 is not divisible by 62. This tool rejects values at or above 248, then applies the remainder. Each symbol has exactly four accepted byte values. It rounds the number of symbols upward to meet the requested entropy.
The random source matters more than a decorative format. The secret generator uses Web Crypto and refuses to fall back to Math.random. The deterministic generator used for mock data is a separate function and must never generate credentials.
Handle the result as a credential
This page creates strings. Your service still needs to register, hash where appropriate, scope, expire and rotate them. Rate limits and access controls remain necessary even with a large random space.
Copy only when needed. A clipboard manager, browser extension or unencrypted download can create another copy outside this page’s control. Store generated credentials in your deployment’s secret facility, then reset the tool. Do not put a secret in a query string or commit it to Git.
Read a secret’s format without reusing the example
Choose 32 bytes and hex when a service expects a 256-bit random secret encoded as text.
Input
32 random bytes · hex · one key · no prefix Fixed test bytes: 0xab repeated 32 times
Expected output
{
"keys": [
"abababababababababababababababababababababababababababababababab"
],
"entropyBits": 256,
"length": 64,
"prefixLength": 0
}The fixed test output illustrates the 64-character format; it is public demonstration data, not a usable credential. A real generation uses fresh Web Crypto randomness. Thirty-two bytes represent 256 bits; a nonsecret prefix contributes no entropy.
Keep the references close
Primary documentation supports the technical details above. Check it alongside the behavior of your own runtime and deployment.
Open API keys & secrets →