We use the browser's built-in Web Crypto API (crypto.getRandomValues()) which sources entropy from the operating system's hardware random number generator. This is far more secure than Math.random(), making the keys suitable for production use in authentication, encryption, and token generation.

API Keys are typically shorter (32 characters), alphanumeric identifiers used for client identification and rate limiting. Secret Keys are longer (64+ characters), include special characters, and are used for signing, encryption, or OAuth client secrets — they must be kept strictly confidential.

For HMAC-SHA256 JWT signing, use at least 256 bits (32 bytes) — that's 64 hex characters or 32 raw bytes. For HS384, use 48 bytes; for HS512, use 64 bytes. Our JWT preset generates a secure 256-bit hex secret. Never use short or predictable secrets for JWT.

AES-256 requires exactly 32 bytes (256 bits) of key material. In hexadecimal representation, this is 64 characters. Our AES-256 preset automatically generates the correct length. AES-128 uses 16 bytes, and AES-192 uses 24 bytes.

For API keys passed in URLs or headers, stick to alphanumeric characters (A-Z, a-z, 0-9) to avoid encoding issues. Special characters like !@#$%^&* are great for server-side secrets and encryption keys that aren't transmitted in URLs.

Store keys in environment variables (.env files), secret management services (AWS Secrets Manager, HashiCorp Vault, Doppler), or your hosting platform's secure configuration. Never hardcode keys in source code or commit them to version control. Use our .env download option for easy integration.

Yes. All generation happens entirely in your browser using the Web Crypto API. Keys are never sent to any server, logged, or stored externally. The entropy source is your device's cryptographically secure random number generator. Once you close the page, the keys exist only if you've saved them.

Entropy measures the randomness (unpredictability) of a key in bits. Higher entropy = stronger security. A 256-bit key has 2²⁵⁶ possible combinations — astronomically large. For reference, 128 bits of entropy is considered secure against brute-force attacks for the foreseeable future. Our tool displays entropy so you can verify your key's strength.