The API Key Generator creates cryptographically secure random keys and secret tokens for use in APIs, webhooks, services and config files. Whether you need a Stripe-style sk_live_ secret, a webhook signing key, or a generic access token, this tool produces high-entropy values that are safe to use in production — generated entirely in your browser.
How it works
The generator draws raw random bytes from the browser’s crypto.getRandomValues CSPRNG (the Web Crypto API), which is suitable for cryptographic secrets. You choose how many bytes of entropy to use (16 to 64) and how to encode them:
- Hex — two characters per byte, using 0-9 and a-f. Easy to read and debug; the most common format for API keys and signing secrets.
- Base62 — alphanumeric (0-9, A-Z, a-z), rejection-sampled per character so no bias is introduced and full entropy is preserved. More compact than hex and safe in URLs and paths.
- Base64url — URL-safe base64 (no
+,/or padding), the most compact encoding. Common for JWTs and short tokens.
An optional prefix such as sk_live_ is prepended verbatim. The encoding changes only the appearance, never the underlying randomness.
How much entropy do you need?
The minimum practical strength for an API key or secret is 128 bits (16 bytes). A brute-force attack against a 128-bit key at a billion attempts per second would take longer than the age of the universe. For most purposes 32 bytes (256 bits) is the standard choice and matches the entropy level used by major providers.
| Entropy | Hex length | Base62 length (approx) | Strength |
|---|---|---|---|
| 16 bytes | 32 chars | ~22 chars | 128-bit — minimum practical |
| 32 bytes | 64 chars | ~43 chars | 256-bit — standard choice |
| 64 bytes | 128 chars | ~86 chars | 512-bit — for signing keys |
When to use each encoding
Hex is the safest choice when you are not sure how the key will be used — it contains only alphanumeric characters (plus letters a–f) and never needs URL-encoding or quoting in config files.
Base62 is ideal when you want a shorter representation of the same entropy and the key appears in URLs or is typed by users. All characters are alphanumeric with no special characters.
Base64url gives the shortest output, which matters for compact tokens like refresh tokens or short-lived session IDs that appear in HTTP headers or URLs. The URL-safe variant avoids + and / which would otherwise need percent-encoding.
Practical notes
- Copy immediately. This tool keeps no record of generated keys. Once you leave or refresh the page, the key is gone.
- Store in environment variables or a secrets manager, never hardcoded in source code or committed to git.
- Treat prefix length as overhead. A prefix like
sk_live_(8 characters) carries no entropy — it is a human-readable label only. The entropy comes entirely from the random bytes after it.