// free · runs in your browser · nothing uploaded
Random API Key and Secret Generator
Make random 40-character letter and number strings for API keys, tokens and app secrets.
1. Options
Your passwords
very strong · 238 bits · a fast attacker would need about longer than the age of the universe to guess it
Tips
- Use a different password for every account, and save them in a password manager.
- 16 or more characters is strong for most accounts. Use 20+ for email and banking.
- Turn on two-step verification wherever you can.
Passwords are made by your browser's secure random generator (crypto.getRandomValues) and never leave your device. We cannot see them.
📚 Official sources: Web Crypto getRandomValues
We build every tool from the official rules and re-check them when they change. Always confirm with the official source before you rely on a result.
🛠️ Spotted a mistake or an out-of-date rule? Tell us
Questions people ask
Is it safe to make a password on a website?+
Here, yes: the password is made by your own browser with its secure random generator (crypto.getRandomValues) and is never sent anywhere. You can even turn off your internet after the page loads and it still works.
How long should my password be?+
At least 16 random characters for normal accounts, and 20 or more for email, banking and your password manager. Length adds more strength than symbols do.
What does 'bits' mean?+
Bits measure how many guesses an attacker would need. Each extra bit doubles the work. Around 80 bits or more is strong enough that guessing is not realistic today.
Why avoid look-alike characters?+
Characters like I, l and 1, or O and 0, are easy to mix up when you read a password aloud or type it from paper, for example a Wi-Fi password. Removing them makes typing easier and only slightly lowers the strength.