When a client secret is generated today it is an UUID:

UUIDs are more expensive to generate, and also have less entropy than a fully randomly generated secret.

One issue with using SecureRandom directly is that it returns a byte array that has to be encoded in order to be used as a secret, for example with base64. However, it just happens to be that there is a utility class in Keycloak that can already generate a random string with a specified character set that removes the need to encode the secret:

For client secrets the proposal is to use a 32 character long randomly generated string using a-zA-Z0-9 as the character set (as the default is for the RandomString utility class).

Using special characters in addition would increase the entropy for a generated secret, but at the other hand it would make it harder to copy/paste secrets.

Entropy for different approaches:

• 32 characters upper/lower/digits: 1.350687001×10⁵⁷
• 32 characters upper/lower/digits/specialchars: 1.104427674×10⁵⁹
• 34 characters upper/lower/digits: 5.025906332×10⁶⁰

For usability it would be better to increase the length rather than including special characters. However, 32 characters is more than sufficient.