—
Entropy: ~— bits
About API key security
A well-generated API key derives its security from entropy, the number of unpredictable bits. This tool uses the browser's crypto.getRandomValues CSPRNG and never transmits keys anywhere. Base64url encodes 6 bits per character (URL-safe, no padding), hex encodes 4 bits per character, and alphanumeric roughly 5.95 bits. For most API tokens, 40 base64url characters (≈240 bits) far exceeds what any attacker could enumerate. Store keys hashed (e.g. SHA-256) server-side and only show them to users once at creation time.