Strength is measured in bits, and the character count does not tell you how many there are. That is the one thing this page exists to make plain.
Ask for "32 characters" and what you get depends entirely on the format. In hexadecimal it is 128 bits, because two characters carry one byte. In base64 it is 192, because four characters carry three bytes. From a 56-character alphabet it is about 185. Same length, and the weakest is barely more than half the strongest. So the bit count is the figure printed large, and the length is a detail underneath it.
A UUID v4 is 122 bits, not 128. Four bits are pinned to the version and two to the variant, which is exactly what makes a UUID recognisable as a UUID. That is a fine trade for an identifier and a poor one for a signing key, and a good deal of software treats the two as interchangeable.
Everything here comes from crypto.getRandomValues, your operating system's cryptographic random source. Nothing uses Math.random, whose internal state can be recovered from a handful of outputs — perfectly good for shuffling a playlist, disqualifying for a key.
Ask in bits rather than characters. 128 bits is the usual floor for anything long-lived and 256 bits is the common choice for a signing key — that is 32 or 64 hexadecimal characters, or 22 and 43 in base64. The character count on its own tells you nothing, which is why the bit count is the large figure on this page.
Because a character carries a different amount of information in each format. Hexadecimal spends two characters on every byte, so it is 4 bits a character. Base64 packs 6 bits into each. An alphanumeric alphabet of 56 characters carries about 5.81. So 32 hexadecimal characters is 128 bits and 32 base64 characters is 192 — the same length and half as much strength again.
Usually not. A UUID v4 is 128 bits long but carries only 122 random ones — four bits are fixed to the version and two to the variant — and a great deal of software treats it as though it were a full 128. It is an excellent identifier: unique, sortable enough, recognisable. For something that signs tokens or protects data for years, generate 32 random bytes instead.
Hexadecimal if it will be read by a person or pasted into a config file — it uses only sixteen characters and survives being retyped. URL-safe base64 if it goes into a URL, a filename or an environment variable, because standard base64 contains plus, slash and padding, all of which bite in those places. A UUID when you want an identifier rather than a secret.
It uses your browser’s cryptographic random source, the same one used for TLS keys, through crypto.getRandomValues. It never uses Math.random, which is a fast non-cryptographic generator whose internal state can be recovered from a handful of outputs — fine for shuffling a list and disqualifying for a key.
No. It is generated in your browser and never transmitted. Nothing is written to our servers and nothing is kept when you close the page, so save it somewhere before you navigate away — we cannot recover it for you.
Multiply by the length to get the strength. It is the only sum on this page that matters.
The same instruction, followed three ways, giving a fifty per cent spread in strength. "How many characters" is the wrong question.
Generated in your browser and never transmitted or stored. Nothing here can be recovered once the page is closed, and a key is only as safe as where you put it next. Nothing you type here is sent to our servers — the calculation runs entirely in your browser.
