Secret Generator

Passwords, passphrases, API keys, encryption keys and UUIDs from your browser’s cryptographic random generator — with the strength in bits.

Free · no sign-up · updated

Runs entirely in your browser. Nothing you enter leaves this page.

requests since opened: 0
Verify it yourself

This page is served with a security policy your browser enforces: it cannot open connections or load anything from other sites — not even to us.

  1. Open your browser’s developer tools (F12, or ⌥⌘I on Mac) → Network tab, then use the tool. No new requests appear.
  2. Or disconnect from the internet after the page loads — the tool keeps working, because it never needed the network.
  3. See the rule itself: in the Network tab, select this page’s document → Response Headers → content-security-policy contains connect-src 'none' and no 'unsafe-inline' for scripts.
  4. Press Test the lock: the page tries a harmless request and the browser blocks it (the Console shows the refusal).

tools v0.9.1 · build 0efa119

How to use
  1. Pick what you need: password, passphrase, key / token or UUID.
  2. Adjust the length or preset; the strength in bits updates as you go.
  3. Copy it — the clipboard is cleared after 30 seconds.

At least one character from each ticked set. Symbols skip quotes, backslashes, spaces and brackets, so the password pastes safely into shells and config files.

≈ 125 bitsvery strong

Result

    Made by your browser’s cryptographic random generator (crypto.getRandomValues). Nothing is stored or sent; copies clear from the clipboard after 30 seconds.

    How strong is strong enough

    Strength is measured in bits of entropy: the base-2 logarithm of how many secrets the generator could have produced. Every extra bit doubles an attacker’s work. Around 80 bits is enough for a password stored with a slow hash; API keys, session tokens and encryption keys should have at least 128 bits, and HMAC secrets such as an HS256 key 256 bits. The number shown assumes the attacker knows exactly how the secret was made — the only honest way to count.

    For a password manager’s master password, six or seven words from the EFF list (about 77 or 90 bits) balance strength and typing.

    Where the randomness comes from

    Every value comes from your browser’s cryptographic random generator (crypto.getRandomValues), never Math.random. Characters and words are picked with rejection sampling, so no character is more likely than another, and secrets are only generated after the page loads in your browser — none exist in the page’s HTML.

    Choosing a format

    Passphrases from the EFF word list are easiest to type and remember. Base64url keys fit in URLs and headers; hex suits configuration files; Base32 is what authenticator apps expect for TOTP seeds. A short prefix such as myapp_live_ makes leaked keys easy to recognise for secret scanners. UUIDs are identifiers, not secrets: version 7 even reveals when it was created.

    Common questions

    How long should a password be?

    Aim for at least 80 bits of entropy for important accounts: about 14 random characters from all four character sets, or 7 words from the EFF wordlist. The generator shows the bits for every setting.

    Are passphrases safer than passwords?

    At the same entropy they are equally strong, and much easier to type and remember. Six random words give about 77 bits — good for a password manager’s master password.

    How long should an API key or JWT secret be?

    At least 32 random bytes (256 bits). For HS256, RFC 7518 requires a key at least as long as the hash output.

    Known limitations
    • Store secrets in a password manager or vault, not in chat or tickets.
    • Strength assumes the attacker knows exactly how the secret was made.
    • UUIDs are identifiers, not secrets; v7 reveals when it was made.
    • Browser extensions can read any page — use a private window for sensitive data. How the lock works

    Related reading on CipherMind

    Standards & references