Password & API Secret Generator

Why does entropy matter more than just "looks random"?

Entropy in bits measures how many attempts a brute-force attack needs on average, mathematically, not just visually. A 12-character password using only lowercase letters has far less entropy than an 8-character one mixing upper, lower, digits and symbols, even though the first looks longer.

What is the difference between the offline and online crack time estimates?

An offline attack (attacker has the hashed secret and unlimited local compute) can try billions of guesses per second on modern hardware. An online attack (guessing against a live login form) is limited by rate limiting and network latency, typically to a handful of attempts per second. The gap between these two numbers is often enormous for the same secret.

Should I use a passphrase or a random string for a webhook secret?

For a machine-to-machine secret (webhook signing key, API key) that nothing ever needs to type or remember, always use the longest random string the receiving system allows. Passphrases exist specifically to be human-memorable, which is irrelevant for a secret only software will ever handle.

Is this tool storing or transmitting the secrets I generate?

No, generation happens entirely in your browser using the Web Crypto API. Nothing is transmitted, logged, or stored, closing this tab clears it completely.

How long should an API secret actually be?

For anything machine-to-machine, 32 characters (roughly 190 bits of entropy with a full alphanumeric-plus-symbol set) is a reasonable default that exceeds what any realistic attack could brute-force within the lifetime of the universe. Some systems impose their own length limits, always defer to the receiving system's documented requirement first.