High-Entropy Secret Key Generator
Create cryptographically secure random passwords, database credentials, API access tokens, and application secrets. Drawn uniformly using hardware random bytes directly in your browser.
High-Entropy Secret Key Generator
Uniformly sampled from CSPRNG without modulo bias
How to Generate High-Entropy Cryptographic Passphrases
1. Adjust Secret Length
Slide the length selector from 8 to 128 characters. 32 to 64 characters is recommended for API keys and webhooks.
2. Select Character Pools
Toggle uppercase, lowercase, numbers, and symbols. Enable "Exclude Ambiguous" to remove easily confused characters (0, O, l, 1, I).
3. Verify Shannon Entropy Score
Examine the live calculated entropy bits (bits of randomness = length * log2(poolSize)).
4. Copy & Secure
Click Copy to capture your high-entropy secret. Store it exclusively in environment variables or secure password vaults.
Rejection Sampling CSPRNG & Modulo Bias Elimination
Naive random password generators take random bytes and apply the modulo operator (byte % poolSize). Because 256 is rarely evenly divisible by the pool size, earlier characters in the pool have a statistically higher chance of selection (modulo bias). Our generator implements strict rejection sampling: any byte exceeding the largest evenly divisible multiple is discarded, guaranteeing true uniform distribution.
| Specification / Parameter | Standard & Enforced Value |
|---|---|
| Entropy Source | W3C Web Crypto API CSPRNG |
| Distribution Method | Rejection sampling (zero modulo bias) |
| Shannon Entropy Formula | H = Length × log2(Character Pool Size) |
| Maximum Length | 128 characters (~830 bits of entropy) |
Production Best Practices for API Secrets & Credentials
Generating a high-entropy secret is only the first step. In production environments, never commit credentials into version control, avoid sharing secrets over messaging apps, enforce automated secret rotation every 90 to 180 days, and use dedicated secret management services.
Frequently Asked Questions: High-Entropy Secrets
What is modulo bias and why does it compromise password generators?
If a random byte (0 to 255) is mapped to an 80-character pool using byte % 80, the first 16 characters are selected by 4 byte values while the remaining 64 are selected by only 3. This skew weakens entropy. Rejection sampling completely eliminates this bias.
How many bits of entropy are required for a secure password?
NIST recommends at least 112 bits for standard applications and 128 bits for high-security environments. A 24-character secret using all character sets provides ~157 bits of entropy.
Can I use these keys for database passwords and API tokens?
Yes. These keys are drawn from hardware entropy and are ideal for PostgreSQL passwords, Redis credentials, Stripe webhooks, and session keys.
Does this generator transmit secrets to your server?
No. All characters are sampled directly in your browser memory. Zero packets leave your machine.