API Key Generator
Generate secure random API keys with a custom prefix like sk_live_. Alphanumeric, hex, Base64url or Base32, any length, with the entropy in bits shown.
Optional, e.g. sk_live_ or myapp_. It makes keys recognizable and easier to detect in leaked code.
190 bits of entropy · 35 characters per value
Generated locally with crypto.getRandomValues; nothing is sent or stored. Keep secrets in environment variables or a secret manager, never in source code.
What is API Key Generator?
Create random API keys for your own services: by default 32 letters and digits with an sk_ prefix, like the keys many SaaS products issue. You can change the prefix, the character set (alphanumeric, hex, Base64url, Base32…), the length and how many keys to generate. The entropy of each key is shown so you can be sure it is strong enough.
How to use API Key Generator
- Set a Prefix (for example
sk_live_ormyapp_) or leave it empty. - Choose the Format and the Length (characters, or random bytes for hex/Base64 formats).
- Set How many keys you need and click Regenerate for new ones.
- Copy the keys and store them hashed on your server.
Example
Prefix sk_, Letters and digits, Length 32
sk_7M1R2Vhc2z6q19CVQAGIOp87bJXcY0wA
190 bits of entropy. Random — your key will differ.
When to use API Key Generator
Use it when building an API and you need to issue keys to clients, or when a service asks you to define your own shared key. Aim for at least 128 bits of entropy. Do not use it to create passwords people must type, and do not store the generated keys in plain text in your database.
How API Key Generator works
Randomness comes from crypto.getRandomValues. For character formats each character is chosen uniformly from the alphabet with rejection sampling, so the entropy is length × log2(alphabet size) — 32 alphanumeric characters give 32 × 5.95 ≈ 190 bits. For byte formats the tool draws N random bytes and encodes them (hex, Base64, Base64url or RFC 4648 Base32), giving 8 × N bits. The prefix is added in front and adds no entropy.
Common Use Cases
- Issuing API keys to customers of a SaaS product
- Creating keys for internal service-to-service calls
- Generating webhook signing secrets
- Producing test keys for staging environments
Security Note
Keys are generated locally and never transmitted. Show a key to its owner only once, store a hash of it, and let users revoke and rotate keys.
FAQs
How long should an API key be?
At least 128 bits of entropy: 22+ alphanumeric characters or 16+ random bytes. The default 32 alphanumeric characters give about 190 bits.
Why add a prefix?
Prefixes like sk_live_ make it clear what a key is for, help users avoid mixing test and live keys, and let secret scanners (such as GitHub secret scanning) detect leaked keys.
How should I store API keys on the server?
Store only a hash (for example SHA-256) of each key and compare hashes when a request arrives, just like passwords, so a database leak does not expose working keys.