Which format?
- Hex for encryption keys and signing secrets that expect a fixed number of bytes.
- Base64 (URL-safe) for tokens that travel in URLs or headers, shorter than hex for the same strength.
- UUID for random identifiers, not for secrets.
How strong is strong enough?
128 bits is beyond any brute-force attack today. 256 bits is the usual choice for keys you never want to rotate for strength reasons. Store secrets in a password manager or a secrets manager, never in source code.