Random Secret Generator
Generate cryptographically secure secrets using crypto.getRandomValues(). Ideal for API keys, session tokens, signing secrets, and encryption keys.
Choosing the Right Length
32 bytes (256-bit) is the standard for most secrets — JWT signing keys, API tokens, session secrets. 16 bytes is acceptable for short-lived tokens or IDs. 64+ bytes for high-security signing keys or when storing long-lived secrets. Always use crypto.getRandomValues() — never Math.random().
crypto.getRandomValues() — calls the OS kernel's CSPRNG (/dev/urandom on Linux, CryptGenRandom on Windows)
A Uint8Array of the requested size filled with unpredictable entropy from the OS
Each byte modulo-mapped to the target alphabet — hex (16), Base64 (64), or alphanumeric (62 chars)
Rejection sampling discards values that would bias the distribution — ensures uniform character distribution
Uniformly distributed, unguessable string — suitable for API keys, tokens, and session IDs
Spec: W3C Web Crypto API §10.1 (getRandomValues), NIST SP 800-90A (DRBG)