Secure Secret Generator
Generate strong random passwords, API keys, access tokens and application secrets. Customize character sets, secret length and the number of secrets you need.
Random Password & Secret Generator
Configure your secret and generate one or multiple independent values.
Character sets
Additional options
Useful when secrets must be read or typed manually. This option reduces the available character pool.
This page uses the browser's Web Crypto API to generate random values. The generated secrets are not submitted to Permitir's PHP server or stored in a Permitir database.
What Is a Secure Secret Generator?
A secure secret generator creates unpredictable random strings for use in authentication, application configuration, API access, integrations and other security-sensitive operations.
Secrets can include passwords, API tokens, application keys, session-related values and other credentials. Their security depends on how they are generated, stored, distributed and managed throughout their lifecycle.
Secure Randomness
Uses the browser's cryptographic random number generator instead of ordinary non-security random functions.
Custom Configuration
Select character groups, output format, length and the number of generated secrets.
Browser-Based
Generation happens locally in the browser without submitting the generated values to the PHP application.
Why use cryptographically secure randomness?
Security-sensitive values must be difficult for an attacker to predict. Ordinary random functions designed for simulations, games or visual effects are not suitable for generating authentication secrets.
This tool uses crypto.getRandomValues(), a browser API designed to provide cryptographically strong random values.
Available Secret Formats
1. Custom passwords and secrets
Choose uppercase letters, lowercase letters, numbers and special characters. This format is suitable for many password and application-secret use cases, subject to the character requirements of the target system.
2. Hexadecimal tokens
Hexadecimal tokens use the characters 0–9 and a–f. They are useful in systems that accept hexadecimal representations of random values.
3. Base64URL tokens
Base64URL uses letters, numbers, hyphens and underscores. It avoids the standard Base64 plus and slash characters and does not use padding in this generator. It can be convenient for URL-oriented token formats, but the receiving application must support the same format.
Understanding Secret Entropy
Entropy is a way to describe the number of possible values a random secret could have. For a uniformly selected character set, the theoretical entropy is:
Entropy = Length × log₂(Character set size)
For example, a 32-character secret selected uniformly from a pool of 94 possible characters has approximately 209 bits of theoretical entropy.
The actual entropy depends on the selected format and character set. The generator calculates the theoretical value for the current settings and displays it with the generated result.
Best Practices for Managing Secrets
- Use unique secrets: Avoid reusing the same API key or password across unrelated applications.
- Choose adequate length: Use longer values when the receiving system supports them.
- Store securely: Use a secrets manager or protected credential store rather than plain-text files.
- Restrict access: Give each secret only the permissions required for its purpose.
- Rotate when necessary: Replace secrets when compromised, exposed or when required by your security policy.
- Protect source code: Never commit production credentials to public repositories.
- Use secure transmission: Distribute secrets through an appropriate protected channel.
- Revoke compromised credentials: Disable exposed keys and investigate potential unauthorized access.
Frequently Asked Questions
Is this secure secret generator free?
Yes. You can generate passwords, tokens and random secrets without creating an account or paying for the tool.
Does the generator use Math.random()?
No. It uses the browser's Web Crypto API and crypto.getRandomValues() to obtain cryptographically strong random values. Character selection uses rejection sampling to avoid modulo bias.
Are generated secrets sent to Permitir?
The generator runs locally in your browser. Its JavaScript does not send generated secrets to the Permitir PHP application or save them in a Permitir database. As with any website, a compromised website, browser extension or device could still expose information.
Can I generate API keys with this tool?
You can generate random strings that may be used as API-key material if the receiving system accepts the selected format and length. Some API providers require their own key format, prefixes, registration or server-side issuance process.
What is the difference between hexadecimal and Base64URL?
Hexadecimal represents each byte using two hexadecimal characters. Base64URL represents binary data using a more compact alphabet of letters, numbers, hyphens and underscores. The formats are different encodings, not different levels of randomness.
How long should a generated secret be?
The appropriate length depends on the purpose, threat model and requirements of the receiving application. Longer random secrets provide more possible combinations, but the application must accept the chosen length.
Should I store generated passwords in plain text?
No. Store credentials in a reputable password manager. Applications that store user login passwords should use a suitable password-hashing algorithm rather than storing plaintext passwords or reversibly encrypting them for authentication.
Does generating a secret automatically secure my application?
No. Secure generation is only one part of secret management. Access control, secure storage, protected transmission, monitoring, revocation and rotation are also important.
More Security Tools
Explore Permitir for additional tools and resources covering encryption, authentication, identity management and application security.