DevBento32 Character Password for API Secrets
Generate a 32 character random password for API secrets and tokens. Cryptographically secure with letters, numbers, and symbols included.
32 Character Password for API Secrets
Machine secrets play by different rules than human passwords: nothing must be memorable, everything must be random. A 32 character output from a cryptographic generator is the standard size for API keys, webhook signing secrets, JWT signing keys, and session tokens.
Entropy Math
| Alphabet | Bits per Char | 32 Char Total |
|---|---|---|
| lowercase only (26) | 4.7 | 150 bits |
| alphanumeric (62) | 5.95 | 190 bits |
| full printable (94) | 6.55 | 210 bits |
Any row beats the 128 bit security target. The tool above uses Web Crypto randomness, not Math.random, so every character is unpredictable.
How to Use
- The tool opens preset to 32 characters, quantity one
- Toggle character sets to match the provider rules (some reject symbols)
- Click Generate until one looks right, then copy once
- Paste straight into your .env or secret manager, never into chat
Storage Checklist
# .env (gitignored)
STRIPE_WEBHOOK_SECRET=whsec_...Keep .env in .gitignore with an .env.example placeholder listing key names only. For teams, prefer a secret manager over shared env files so rotation does not mean messaging secrets around.
For keyed hashing of these secrets see the Hash Generator, or craft the ignore file with the Gitignore Generator.
Nothing you paste leaves this tab. Every tool runs entirely in your browser — no upload, no server, no account.