3 ms·
"Hashing" and "random keys" are different. The author keeps mentioning "hashing" but it's "number of true random bits" that matters. If the generation of those
by jwatte 10y ago
"Hashing" and "random keys" are different. The author keeps mentioning "hashing" but it's "number of true random bits" that matters.
If the generation of those keys uses pseudo random data, time, etc, the risk of collision goes up.
Read 16 bytes from /dev/urandom and stuff them into base64encode and you have a pretty good random API key in readable ASCII.
- Bino 10y agoI usually try to avoid base64 when encoding data/password/keys to users. Due to it's large/"odd" charset. I would recommend using binary to hex (base16) notation or base32.
- jwatte 10y agoWhy is it bad to use case sensitive alpha plus digits plus two punctuation? The article already uses 62 chars (minus the two punctuation.) If you encode fewer bits per character, you get a longer key but no more security.) Raw binary: 16 bytes Base64: 22 bytes Base32: 26 bytes Base16: 32 bytes The only reason to use base 32 is codes that a human may enter (promo, verification, serial) to remove case and O/0 ambiguities. The only reason to use base 16 is laziness (some APIs generate this for you.) API keys are presumably copied from the generation page and pasted into the local app config file.