A random 32-character password is key-grade strength for API secrets, tokens and encryption passphrases. With all 94 printable characters it has about 210 bits of entropy. Use the generator above — it opens at 32 characters, and you can still adjust the length if a site needs something different.
32-character secrets for developers
Thirty-two characters is a common size for application secrets: Laravel’s APP_KEY, Django’s SECRET_KEY, JWT HMAC secrets, webhook signing secrets, cookie and session keys, and many API tokens. With all character types a random 32-character string carries about 210 bits of entropy; letters and numbers only still give about 190 bits.
Choosing the right character set
- Letters and numbers only — safe in URLs, headers, environment variables and JSON without escaping. Untick symbols.
- Full set — maximum density; fine when the value is stored in a secrets manager.
- Hex secrets — if a library expects 32 hex characters (128 bits), note that hex carries 4 bits per character; for 256-bit keys you need 64 hex characters, so use a dedicated key generator such as
openssl rand -hex 32.
Handle secrets carefully
- Store them in a secrets manager or environment variables, never in Git.
- Use different secrets for development, staging and production.
- Rotate immediately if a secret appears in logs, screenshots or a public repository.
How strong is a 32-character password?
The table shows how many different 32-character passwords exist for each character set, and how long an offline attacker testing 100 billion guesses per second (a multi-GPU rig against a fast hash such as MD5 or NTLM) would need on average to find a randomly generated one.
| Character set | Possible passwords | Entropy | Average time to crack |
|---|---|---|---|
| Numbers only (0–9) | 1.0 × 1032 | 106 bits | far longer than the age of the universe |
| Lowercase letters | 1.9 × 1045 | 150 bits | far longer than the age of the universe |
| Letters (A–Z, a–z) | 8.2 × 1054 | 182 bits | far longer than the age of the universe |
| Letters + numbers | 2.3 × 1057 | 191 bits | far longer than the age of the universe |
| All printable characters | 1.4 × 1063 | 210 bits | far longer than the age of the universe |
These figures assume the password is truly random. A 32-character password built from a word, a name or a date can be cracked in a tiny fraction of this time. Check any password with the strength checker.
Other password lengths
- 8 characters
- 10 characters
- 12 characters
- 14 characters
- 15 characters
- 16 characters
- 20 characters
- 24 characters
- 32 characters
- 64 characters
Last updated: · Reviewed by the Password Generator team