Sometimes the requirement is not "256 bits of entropy" but "exactly 40 characters, alphanumeric only" — because a database column is CHAR(40), a legacy validator rejects punctuation, or a spec was written that way a decade ago. This generator works from the character count inward, then tells you how much entropy that actually gives you.
Characters are not bits
The alphabet determines how much entropy each character carries:
| Alphabet | Symbols | Bits per character | 32 characters gives |
|---|---|---|---|
| Digits | 10 | 3.32 | 106 bits |
| Hex | 16 | 4.00 | 128 bits |
| Lowercase + digits | 36 | 5.17 | 165 bits |
| Base58 | 58 | 5.86 | 187 bits |
| Alphanumeric | 62 | 5.95 | 190 bits |
URL-safe (with -_) | 64 | 6.00 | 192 bits |
A 32-character hex token and a 32-character alphanumeric token differ by 62 bits — a factor of about 4.6 × 10¹⁸. If a system constrains you to hex, compensate with length.
Choosing an alphabet
Hex when the value will be compared, logged or diffed by humans. The fixed two-characters-per-byte mapping makes a truncated value obvious.
Alphanumeric when you need density and the consumer is a header or a JSON field.
Base58 when the token may be transcribed. Dropping 0, O, I and l eliminates the transcription errors that actually happen.
Lowercase only when the token passes through a case-insensitive system — some DNS-based and email-based flows lowercase everything, which silently destroys half the entropy of a mixed-case token if you have not planned for it.
Digits only for codes typed on a phone keypad, and only with strict attempt limiting. See the one-time password generator for that case.
The 96-bit floor
For any credential that authenticates a request, treat 96 bits as the minimum and 128 as the target. Below that, an attacker with a large botnet and an API that does not rate-limit per key can make brute force practical. Above 128, the attack moves elsewhere. The entropy readout on this page saturates at 128 for exactly that reason.
Frequently asked questions
My API requires exactly 32 characters. Is that enough?
It depends entirely on the alphabet. 32 hex characters is 128 bits — fine. 32 digits is 106 bits — acceptable but not generous. 32 alphanumeric characters is 190 bits — comfortable. Check the entropy readout rather than the character count.
Why does the generated token not use every character in the alphabet?
Randomness is not uniformity. A truly random 32-character token from a 62-symbol alphabet will usually be missing many symbols and will repeat several. A token that used every character exactly once would be the suspicious one.
Is a token with a repeated character weaker?
No. Each character is drawn independently, so aab is exactly as likely as abc. Rejecting tokens that contain repeats actually *reduces* entropy by shrinking the output space.
How do I check the strength of a token I already have?
Paste it into the entropy and brute-force calculator, which infers the alphabet, computes the search space, and flags structural weaknesses that raw entropy maths cannot see.