How many bits is a hex API key actually?

A hex string like a3f9c2... is quietly doing a specific amount of work for you, and that amount is easy to compute exactly — no rounding, no hand-waving about "long enough." Hexadecimal has exactly 16 possible characters per position (0–9 and a–f), and 16 is 2^4, so every single hex character you add contributes exactly 4 bits of entropy, provided it comes from a genuinely random source. The whole calculation is one multiplication: 4 times the number of characters.

The method

1. Confirm the key is drawn from a cryptographic random source, not a predictable one (a timestamp, a counter, a weak PRNG). The bit math below is only honest if every character is actually unpredictable — length alone guarantees nothing if the generator behind it is weak.
2. Count the characters in the key.
3. Multiply by 4, since log2(16) = 4 exactly — one hex character is one of 16 equally likely values, and that holds for every position independently.
4. Compare the result to what the key protects: a session token that expires in an hour has a different bar than a long-lived API secret that, if leaked, can be replayed indefinitely until someone notices and rotates it.
5. If you need a round, memorable "128-bit" or "256-bit" figure for documentation, work backwards: 128 bits needs 32 hex characters, 256 bits needs 64, because the relationship is exact in both directions.

A worked example

This site's API key generator defaults to 40 hex characters, and lets you choose anywhere from 8 to 128.

• Default, 40 characters: 40 × 4 = 160 bits.
• Minimum, 8 characters: 8 × 4 = 32 bits — guessable by brute force in a reasonable time on ordinary hardware, fine only for something low-stakes and short-lived.
• Maximum, 128 characters: 128 × 4 = 512 bits — far beyond what any plausible attack needs, useful mainly when a system has a fixed field width and you want to fill it.
• The commonly cited "128-bit key" is exactly 32 hex characters: 32 × 4 = 128.

Notice the relationship is linear and exact in both directions — there's no curve to eyeball, no "roughly" needed. If a vendor's docs ask for a 256-bit key, you need exactly 64 hex characters, not a guess at "a long one."

What length doesn't fix

Bit count measures how hard the key is to guess blind; it says nothing about how it's stored, transmitted or logged. A 512-bit key pasted into a URL query string, logged by every proxy it passes through, or committed to a public repository is compromised regardless of its length — the arithmetic above assumes the attacker's only option is guessing, which stops being true the moment the key leaks some other way. Generate the key long enough for what it protects, then treat it like the secret it is. The API Key generator prints the exact bit figure for whatever length you choose, straight from your browser's cryptographic random source.