API Key Generator
An API key is a secret token used to authenticate requests between services, applications, and APIs. This generator uses the Web Crypto API (crypto.getRandomValues) to produce cryptographically secure random keys — meaning they are generated from a high-entropy source and are practically impossible to guess or brute-force.
You can customize the key length (8–128 characters), choose between hexadecimal (0–9, a–f) or Base62 (0–9, A–Z, a–z) encoding, add an optional prefix such as 'sk_' or 'pk_live_', and generate multiple keys at once. Keys are never sent to any server — everything runs locally in your browser.
How it works
Each key character is derived from a random byte produced by crypto.getRandomValues(). For hex output, each byte maps to two hex digits (00–ff). For Base62, each byte is taken modulo 62 and mapped to a character from the set [0-9A-Za-z], giving approximately 5.95 bits of entropy per character.
Use cases
- Generating API keys for SaaS products and backend services
- Creating secret tokens for webhook signatures and HMAC authentication
- Provisioning temporary access tokens for testing and development environments
- Producing secure random identifiers for database records or session IDs
- Generating multiple keys in bulk for seeding staging or QA environments
Frequently asked questions
How do I generate a secure API key?
Use a cryptographically secure random source instead of ordinary random functions like Math.random. This generator relies on the Web Crypto API (crypto.getRandomValues), which draws from a high-entropy source, so the resulting keys are practically impossible to guess or brute-force.
What is a good length for an API key?
For most applications, 32 characters or more is a solid choice. In Base62 each character carries about 5.95 bits of entropy, so a 32-character key holds roughly 190 bits — far beyond what is feasible to brute-force. In hex, each character carries only 4 bits, so you need longer keys (e.g., 64 hex characters for 256 bits).
What is the difference between hex and Base62 encoding?
Hexadecimal uses 16 characters (0-9, a-f) and encodes 4 bits per character, while Base62 uses 62 characters (0-9, A-Z, a-z) and encodes about 5.95 bits per character. That means a Base62 key can be significantly shorter than a hex key with the same security level. Hex is often preferred when the key must map cleanly to raw bytes.
Are the generated keys sent to a server?
No. Everything runs locally in your browser using the Web Crypto API, and no key is ever transmitted or stored anywhere. Once you close or refresh the page, the generated keys are gone, so copy and store them securely before leaving.
Why do API keys use prefixes like sk_ or pk_live_?
Prefixes identify the type and environment of a key at a glance — for example, secret versus public, or live versus test. They also help secret-scanning tools detect leaked keys in code repositories. A prefix adds no cryptographic strength; the security comes entirely from the random portion of the key.