How to use the password and secret generator

Pick a mode: Password, API key, Random secret or Nanoid.
Adjust the options. A new value is generated every time you change one.
Set How many to create a batch, one value per line.
Press Generate for fresh values and Copy to copy them.

Example

A 20-character password from all four character sets looks like q7#Vt2>mZ!c9Lr_eW4xP and carries about 129 bits of entropy (20 × log2 of 89 characters). An API key with the prefix sk_live_ and a 32-character base62 body looks like sk_live_4fT9kQ2bXz7LmN1pR8sV0wYc3dHe6JaG (about 190 bits). A 32-byte random secret in hex is 64 characters, the usual size for an HMAC or session signing key.

Frequently asked questions

How random are the values?

Every character comes from crypto.getRandomValues, the browser's cryptographically secure random generator. Random numbers are drawn with rejection sampling, so each character in the alphabet is exactly as likely as any other, with no modulo bias. Passwords always contain at least one character from each set you chose.

What does the entropy figure mean?

It estimates how many guesses an attacker needs: each extra bit doubles the work. Around 80 bits is plenty for a password behind rate limiting; use 128 bits or more for API keys and signing secrets.

Are the generated secrets stored or sent anywhere?

No. They are created in your browser and never leave it. Nothing is logged, so copy the value before you leave the page.