API Key Generator
Generate cryptographically secure API keys in any format - hex, Base64, UUID v4, or custom character sets. Choose bit lengths from 128-bit to 1024-bit, add optional prefixes and separators, and batch generate up to 50 keys at once. All keys are generated locally using the Web Crypto API - no data ever leaves your device.
Generate cryptographically secure API keys in multiple formats. Choose from hex, Base64, UUID v4, or custom character sets with adjustable length, optional prefixes, and visual separators - all generated locally using the Web Crypto API.
Configure your key options above and click Generate
All keys are generated using cryptographically secure randomness - no data uploaded
Why Use Our API Key Generator?
Multiple Format Support
Generate API keys in six different formats: UUID v4, lowercase hex, uppercase hex, standard Base64, URL-safe Base64, and custom character sets. Each format is generated using cryptographically secure random values from the Web Crypto API.
Cryptographically Secure
All keys are generated using crypto.getRandomValues() - the same cryptographically secure random number generator used by browsers for TLS and encryption. No Math.random() is used, ensuring true cryptographic randomness with no predictability.
Batch Generation & Export
Generate multiple keys at once with adjustable bit lengths from 128-bit to 1024-bit. Each key shows its entropy level so you can verify it meets your security requirements. Copy individual keys or all generated keys with one click.
Customizable Options
Customize every aspect of your API keys: choose from 6 character set presets for custom formats, add optional prefixes (sk-, pk-, api-, etc.), include visual separators every N characters, and select from 10 preset prefix templates.
Common Use Cases for API Key Generator
REST API Key Generation
Generate secure API keys for your RESTful web services. Create keys in hex or base64 format with custom prefixes that identify the environment (sk_live_, pk_test_) and permissions (read, write, admin) - following industry best practices used by Stripe, GitHub, and major API providers.
Application Authentication Tokens
Generate cryptographically secure authentication tokens for your applications. Use UUID v4 for unique session identifiers, or generate high-entropy base64 tokens for OAuth2 bearer tokens and JWT signing secrets.
Development & Testing Keys
Create disposable API keys for development, staging, and testing environments. Use the "test-" prefix preset to clearly identify non-production keys, and generate keys with lower bit lengths when security requirements are relaxed.
Client & Partner Access Keys
Provision unique API keys for third-party clients, partners, and integrations. Generate keys with consistent prefixes and formats for easy identification in logs and dashboards, with sufficient entropy to prevent brute-force attacks.
Database Connection Secrets
Generate strong database passwords and connection string secrets. Use the custom format with ASCII printable characters to ensure maximum password strength, or use hex format for password managers that support hexadecimal inputs.
CI/CD Pipeline Secrets
Create secrets for your continuous integration and deployment pipelines. Generate keys with environment-specific prefixes (dev-, prod-, test-) for GitHub Actions secrets, GitLab CI variables, or environment variable configuration.
Understanding API Key Generation
What Makes an API Key Secure?
A secure API key must be cryptographically random, meaning it is generated using a true random number generator that produces unpredictable output. The key's entropy, measured in bits, determines how many guesses an attacker would need to brute-force the key. Each additional bit doubles the difficulty. For modern security, API keys should have at least 128 bits of entropy (equivalent to a 32-character hex string), with 256 bits recommended for high-security applications.
Key Formats and Their Uses
UUID v4 (128-bit) is standard for unique identifiers but contains predictable bits (version and variant). Hex keys are widely used in password managers and configuration files. Base64 offers the highest density of entropy per character (6 bits per character vs 4 bits for hex). Custom character sets let you restrict keys to specific character classes, which can be useful when integrating with systems that have character limitations.
How Our API Key Generator Works
- Random Bytes: The Web Crypto API generates cryptographically secure random bytes using the operating system's true random number generator (e.g., /dev/urandom on Linux, CryptGenRandom on Windows).
- Encoding: The random bytes are encoded into the selected format. For hex, each byte becomes two hex characters. For Base64, every 3 bytes become 4 characters. For custom charset, rejection sampling ensures uniform distribution without bias.
- Formatting: Optional prefixes, visual separators, and custom formatting are applied. Each generated key includes its entropy calculation so you can verify it meets your security requirements.
Privacy & Security
All key generation happens entirely in your browser using the Web Crypto API (crypto.getRandomValues). No data is uploaded to any server - the generated keys never leave your device. This means you can generate sensitive production API keys, database passwords, and authentication tokens with complete privacy. The tool is completely free and requires no signup or network access after the initial page load.
Related Tools
DNS Propagation Checker
Check if DNS changes have propagated by querying multiple global nameservers (Cloudflare, Google, Quad9). Shows propagation status across regions with live results and colour-coded status indicators - free online DNS propagation checker.
Domain Age Checker
Check the age of any domain in years, months, weeks, and days. Enter a domain name to get its creation date, registration timeline, registrar info, and SEO authority estimate based on domain age - all fetched from the official RDAP registry in real time. Free online domain age checker.
Bulk WHOIS Lookup
Check domain registration information for up to 20 domains at once using the RDAP protocol. View registrar, creation date, expiry date, nameservers, and domain status codes in a sortable table - free online bulk WHOIS lookup.
Domain Expiry Checker
Check when any domain expires - enter a domain name to see its expiration date, days remaining, registrar lock status, auto-renew status, and complete WHOIS details. Colour-coded health indicators show whether renewal is urgent. Free online domain expiry checker.
Frequently Asked Questions About API Key Generator
Base64 and custom character sets with high entropy per character are the most secure formats for a given key length. However, for a given entropy target, the format matters less than ensuring you generate enough random bits. We recommend at least 128 bits of entropy (a 32-character hex string or a 22-character Base64 string) for general use, and 256 bits for high-security applications.
Yes. All keys are generated using crypto.getRandomValues(), which is the Web Crypto API's cryptographically secure random number generator. This is the same randomness source used for TLS encryption, HTTPS, and browser security. It draws entropy from the operating system's true random number generator, not from pseudo-random Math.random().
Entropy measures the unpredictability of a key in bits. A key with 128 bits of entropy would require an attacker to make up to 2^128 guesses to find it through brute force - a number so large it is practically impossible with current computing power. The entropy displayed for each key lets you verify that your key meets your security requirements at a glance.
Standard Base64 uses "+" and "/" characters, which can cause issues in URLs and filenames. URL-safe Base64 replaces "+" with "-" and "/" with "_", and strips the "=" padding characters. This makes URL-safe Base64 suitable for use in query parameters, REST API paths, and JWT tokens without requiring additional URL encoding.
Prefixes like "sk-" (secret key), "pk-" (public key), or "sk_live_" (live secret) serve multiple purposes: they make keys immediately identifiable in logs and dashboards, they prevent accidentally mixing production and development keys, and they allow code to programmatically detect key types without inspecting the full key value - a pattern used by Stripe, GitHub, and many major API providers.
For most use cases, generating keys one at a time is sufficient since the Web Crypto API provides true randomness for each key. Batch generation (up to 50 keys at once) is useful when provisioning keys for multiple clients, team members, or environments in a single session. Each key is independently generated with fresh random bytes.
No. Each API key should be unique to a specific service, application, or user. Using the same key across multiple services means compromising any one service exposes all of them. Always generate separate, independent keys for each service, environment, and user. This is a fundamental security principle called "least privilege."
128-bit keys (32 hex characters or 22 Base64 characters) are suitable for most applications. 256-bit keys provide stronger security and future-proofing against advances in computing power. 512-bit and 1024-bit keys are available for very high-security environments, though the additional entropy provides diminishing returns beyond 256 bits for most practical purposes.
Yes, the API Key Generator is completely free to use. All key generation happens locally in your browser using the Web Crypto API - no data is uploaded to any server, no API keys are required, and no signup is needed. You can generate as many keys as you want with complete privacy, including sensitive production keys.