Skip to content
Page Utils

API Key Generator

An API key generator creates long random strings you can hand out as API keys, client secrets, or webhook signing secrets. Pick a format (Base62, hex, Base64URL, Crockford Base32, or UUID v4), a length, and an optional prefix such as sk_live_, then Generate and Copy. Every character comes from crypto.getRandomValues in your browser; nothing is stored or sent.

Updated

Each random character is drawn with the Web Crypto random source (crypto.getRandomValues) and rejection sampling, so there is no Math.random and no modulo bias. The entropy meter counts only the random part: 32 Base62 characters carry about 190 bits, 32 hex characters exactly 128 bits, and a UUID v4 has 122 random bits. A readable prefix like sk_live_ or pk_test_ helps people and secret scanners recognise the key, but it is not random and adds no strength.

Keys exist only in this tab's memory. The page does not write them to localStorage, does not post them to Page Utils or any API, and shows no ads. Tick Show SHA-256 to get a hash of each key computed with Web Crypto — store that hash in your database and show the raw key to the user once. This page generates random strings; it does not register keys with any provider, rotate them, or check whether a key has leaked.

API key workspace

crypto.getRandomValues
Format

16 to 128 random characters after the prefix. 32 Base62 characters ≈ 190 bits.

Optional, e.g. sk_live_ or pk_test_. Letters, digits, _ - . only; it is not random and adds no entropy.

1 to 20 keys, one per line.

Strength

Strong · ≈191 random bits. Aim for 128+.

Output

  • API keys appear here in the browser after the page loads.

How does the API Key Generator work?

  1. 1. Pick a format

    Base62 (letters and digits) is the common default for API keys. Hex is easy to store in fixed-width columns, Base64URL packs the most bits per character, Crockford Base32 avoids look-alike letters, and UUID v4 gives a standard 36-character id.

  2. 2. Set length and prefix

    Drag the length slider (16–128 random characters) and watch the entropy meter — aim for 128 bits or more. Add an optional prefix such as sk_live_ or pk_test_ so keys are recognisable in logs and secret scanners.

  3. 3. Generate and copy

    Choose how many keys (1–20), press Generate for a fresh batch, and copy one key or all of them. Each press draws new values from crypto.getRandomValues.

  4. 4. Store the hash, not the key

    Tick Show SHA-256 to see a hash of each full key. Save the hash server-side, show the raw key to its owner once, and compare hashes when a request arrives. Close the tab when you are done; nothing is kept.

Questions about API Key Generator

What is an API key generator?
An API key generator makes long, unpredictable random strings to use as API keys, client secrets, or webhook signing secrets. This one runs in your browser with crypto.getRandomValues, supports Base62, hex, Base64URL, Crockford Base32, and UUID v4 formats, and can add a readable prefix like sk_live_.
Are the keys generated here secure?
The random part comes from crypto.getRandomValues, the browser's cryptographically secure random source, with rejection sampling so every character is equally likely. With the default 32 Base62 characters a key has about 190 bits of entropy, far beyond brute force. Security then depends on how you store and transmit the key.
Are my API keys stored or sent anywhere?
No. Keys are created and shown in this tab only. The page does not write them to localStorage or cookies, does not send them to Page Utils or any API, and carries no ad slot. Close or reload the tab and they are gone.
How long should an API key be?
Aim for at least 128 bits of randomness. That is 32 hex characters, 22 Base62 characters, or 22 Base64URL characters. Many providers use 32–40 Base62 characters (about 190–240 bits). Longer keys cost nothing at runtime, so err on the long side.
Should I add a prefix like sk_live_?
A prefix is a good idea: it tells people which environment or key type they are holding, and lets secret scanners such as GitHub secret scanning spot leaked keys. The prefix is fixed text, so the generator counts entropy only for the random characters after it.
Which format should I choose: Base62, hex, Base64URL, or UUID?
Base62 is a safe default — URL- and header-safe with no punctuation. Hex is simple and fixed-width but needs more characters for the same strength. Base64URL packs 6 bits per character but includes - and _. Crockford Base32 avoids I, L, O, and U for keys people read aloud. UUID v4 is fine when you need a standard id, but it carries only 122 random bits.
How should I store API keys on my server?
Store a hash, not the key. Show the raw key to its owner once, save SHA-256 of the full key (this page can compute it locally), and on each request hash the presented key and compare. Because keys are long and random, a fast hash like SHA-256 is fine; passwords, which are short and guessable, need a slow hash such as bcrypt or Argon2 instead.
Is an API key the same as a password or a JWT?
No. A password is chosen or remembered by a person; use the Password Generator for that. A JWT is a signed token that carries claims and expires; use the JWT Token Generator to sign one. An API key is an opaque random secret your server looks up — it carries no data of its own.

What else can I open?

These tools run in your browser. Page Utils does not store, upload, or write to localStorage the keys, tokens, or text you paste. Results are a convenience aid, not legal, tax, or security advice.