Are the keys truly random and secure?

Yes. Keys are generated with window.crypto.getRandomValues(), the W3C WebCrypto API, which provides cryptographically strong random numbers sourced from the OS entropy pool. They are suitable for use as secrets.

Is any key data sent to your servers?

No. All generation happens inside your browser. No key value is ever transmitted over the network. You can verify this by going offline and using the tool — it works identically.

What is the difference between the formats?

Hex produces lowercase hexadecimal (0-9, a-f), doubling the byte count to characters. Base64 (URL-safe, no padding) uses A-Z, a-z, 0-9, -, _ and is more compact. Alphanumeric uses only letters and digits, safe for any URL or config file. UUID produces a standard RFC 4122 v4 universally unique identifier.

How long should my API key be?

For most applications, 256 bits is more than enough. That is a 64-character hex key (each hex character carries 4 bits) or a 43-character Base64URL key (6 bits each). The length slider moves in steps of 4, so pick 44 for Base64URL.

Can I use UUID as an API key?

UUIDs are valid random identifiers (122 bits of entropy) and work well as API keys, database row IDs, or idempotency keys. They are slightly less compact than a hex or base64 key of the same byte length.

How should I store API keys on my server?

Store a hash of each key, such as SHA-256, and show the full key to its owner only once. Then a database leak does not hand out working keys. Keep keys out of source code and front-end JavaScript.

Why do some API keys start with a prefix like sk_live_?

A short prefix tells people and secret scanners what the key is for and which environment it belongs to, which makes a leaked key easier to spot and revoke. This tool makes the random part; add your own prefix in front of it.

API Key Generator

Choose a format and length, then generate cryptographically secure API keys instantly — all client-side using WebCrypto. No server, no logging.

Pick a format and length, then click Generate Key.

Key Options

Format

Key Length 32 chars

864128256

Batch Count (1 – 20)

Click Generate Key to create your first key

Copied!

Quick answer

Pick a format and length, then click Generate Key. Keys come from crypto.getRandomValues in your browser and are never sent anywhere. A 64-character hex key holds 256 bits of randomness, which is plenty for an API key or an HMAC secret.

Examples

Format	Length	Randomness
Hex	32 characters	128 bits
Hex	64 characters	256 bits
Base64URL	44 characters	264 bits
Alphanumeric	44 characters	about 262 bits
UUID v4	36 characters	122 bits

Choose a format and generate a key.

Summary

Generate cryptographically secure API keys using WebCrypto — hex, base64, alphanumeric, or UUID, with configurable length and batch support.

How it works

window.crypto.getRandomValues() fills a Uint8Array with cryptographically random bytes drawn from the operating system entropy pool.
The random bytes are encoded into your chosen character set: lowercase hex, URL-safe Base64, or alphanumeric.
For UUID mode, the bytes are formatted as an RFC 4122 version 4 identifier with the version and variant bits set correctly.
The finished key is rendered instantly in the browser and is never transmitted or logged.

Use cases

Create API authentication tokens for REST APIs and webhooks.
Generate secret keys for HMAC signing or JWT secrets.
Produce random UUIDs for database primary keys or session IDs.
Bulk-generate test credentials for staging environments.
Generate client secrets for OAuth 2.0 application registration.

Frequently Asked Questions

Last updated: 2026-05-23 · Reviewed by Nham Vu