This API key generator creates random keys in your browser, with optional prefixes and the encodings real services use. Nothing is transmitted, and it keeps working offline once the page has loaded.
What is an API key?
An API key is a random value an application sends with each request so a service can tell who is calling. It identifies the caller rather than proving a person's identity, which is what separates it from a password or a login session.
API key vs token vs secret
The three terms overlap in everyday use, but they behave differently, and an API key generator only produces the first of them.
A key identifies an application and usually never expires. A token represents a session or a delegated permission and does expire. A signing secret is never transmitted at all — it is used to compute a signature, as with a JWT secret.
Why keys must be unpredictable
A key is a bearer credential: whoever holds it gets the access. There is no second factor and usually no rate limit generous enough to save you.
That makes predictability the whole risk. A key derived from a timestamp, a counter, orMath.random() can be guessed without ever touching your servers, which is the reason to use a proper API key generator rather than improvising one.
What these keys are and are not
A format is not a credential
This API key generator offers presets shaped like keys from well-known services. They reproduce the visible pattern — the prefix, the length, the alphabet — and nothing else.
A generated value grants no access to any third-party service. It is a random string that happens to look familiar. Stripe, GitHub and OpenAI have no knowledge of it.
Where real keys come from
Every service issues its own credentials, and only from inside your account: the Stripe dashboard, GitHub developer settings, the OpenAI account page. No third-party tool can mint one, and any tool claiming otherwise is either mistaken or lying.
What this tool is actually for
Issuing keys for an API you run yourself, where you decide the format and validate it. That is the case this API key generator is built for.
It also covers the everyday cases around real keys: seeding test fixtures, filling documentation examples with something that is obviously not live, and checking that your log redaction actually catches a sk_ prefix before a real key reaches production.
Anatomy of an API key
The prefix
Most modern keys start with a short, fixed label: sk_test_, ghp_,sk-. It tells you at a glance what a value is and which environment it belongs to.
Prefixes also make automated secret scanning possible. A scanner looking for ghp_followed by 36 alphanumerics can flag a leaked token within seconds, which is why an API key generator should let you set one.
Why the prefix adds no security
A prefix is public. It appears in documentation, in logs, and in every other key the same service issues, so an attacker never has to guess it.
That means it contributes exactly zero bits of entropy. Counting it would overstate a Stripe-shaped key by roughly 48 bits, which is the difference between a strong key and an unbreakable one on paper only.
A diagram splitting an API key into a public prefix and a random body. The prefix, such as sk_test_, is fixed and publicly known, so it contributes zero bits of entropy. The 24-character random body contributes about 143 bits. Counting the eight prefix characters as if they were random would overstate the key's strength by roughly 48 bits.
The random body
Everything after the prefix comes from crypto.getRandomValues() with rejection sampling, so this API key generator draws every character in the alphabet with equal probability.
Thirty-two Base62 characters carry about 191 bits. For comparison, 128 bits is the point beyond which brute force stops being a consideration at all.
Encoding: Base62, hex, or Base64URL
The alphabet an API key generator uses decides how much entropy each character carries, and how well the value travels through the systems that will handle it.
A comparison of three encodings over 32 characters. Hexadecimal gives 128 bits using 16 symbols. Base62 gives about 191 bits using 62 alphanumeric symbols. Base64URL gives 192 bits using 64 symbols, only 1.5 bits more than Base62, but it introduces hyphen and underscore characters that are not alphanumeric.
Base62 is the default in this API key generator because the extra entropy from Base64URL is negligible and the extra characters are not.
How to use this API key generator
Pick a format
Start with Generic for an API you control. The vendor-shaped presets exist so you can test how your own code handles those formats, and each one shows a warning to keep that unambiguous.
Set the length
The slider counts random characters only, so a prefix never inflates the number this API key generator reports. Thirty-two is a sensible default; go higher when the key protects something irreplaceable.
Generate in bulk
Raise the quantity to as many as 50 and download the list as a text file. Running the API key generator in bulk is the quickest way to populate a staging environment with values that are clearly not production keys.
Handling API keys safely
Never commit them
Keep keys in environment variables or a secret manager, never in source control. Git remembers everything, so a key pushed once is exposed even after the commit disappears.
Rotate on a schedule
Rotation limits how long a leaked key stays useful. If rotating is painful, that is a sign the key is embedded somewhere it should not be.
Scope them narrowly
Issue a separate key per integration, with only the permissions that integration needs. A key that can do everything turns any single leak into a total compromise.
What to do if one leaks
Revoke first, investigate second. Running an API key generator to replace a key takes a minute; working out what an attacker did with the old one takes days.
Then mint the replacement with an API key generator or with whatever the service provides, and check your logs for any use of the old value.
Frequently asked questions
Can I use these keys to access Stripe, GitHub, or OpenAI?
No. This tool produces random values shaped like those services’ keys, but it has no connection to any of them. A working key can only be issued by the service itself, from your own account dashboard.
What is this API key generator actually for?
Issuing keys for an API you control, seeding test fixtures, filling in documentation examples, and checking that your own code parses and redacts key formats correctly.
Are the generated keys stored anywhere?
No. They are created in your browser with the Web Crypto API and never sent to a server. You can confirm it in your browser’s network panel, or by disconnecting from the internet and generating again.
How long should an API key be?
Thirty-two Base62 characters give about 191 bits, which is far beyond brute force. Anything above 128 bits is comfortable. Below 64 bits is not, regardless of how long the prefix makes it look.
Does the prefix make the key more secure?
No. A prefix is public and predictable, so it contributes no entropy at all. It exists to make keys identifiable in logs and scannable by secret-detection tools. The entropy readout in this API key generator counts only the random portion.
What is the difference between an API key and a token?
An API key usually identifies an application and does not expire. A token usually represents a session or a delegated permission and does expire. Keys are simpler to use; tokens are safer for anything user-facing.
Which encoding should I choose?
Base62 is the safe default because it is alphanumeric only, so it survives URLs, headers and shell commands unescaped. Hex is useful when a value must map to an exact bit length. Base64URL packs slightly more entropy per character.
What should I do if a key leaks?
Revoke it at the source immediately, then issue a replacement. Rotating is always cheaper than working out what an attacker did with it. If it reached a git repository, treat it as compromised even after you remove the commit.
More free generators
Every generator here runs locally in your browser, with no account and no limits. For a raw value with no key conventions at all, use the random string generator.
Password Tools
Random Generators
Keys & Secrets
Methodology
Last updated
How entropy is calculated
entropy = randomLength × log₂(alphabet size)
The prefix is excluded deliberately. It is public and fixed, so it gives an attacker nothing; including it would overstate a key with an 8-character prefix by about 48 bits. Alphabet sizes are 62 for Base62, 16 for hex and 64 for Base64URL.
How the vendor-shaped presets work
Each preset reproduces the publicly visible pattern of a service's keys: the prefix, the length and the alphabet. Nothing more is copied, and nothing is derived from any real key.
Generated values are random and grant no access to any service. Presets always carry a-style suffix, and selecting one displays a disclaimer inside the tool.
Where the randomness comes from
Every character comes from crypto.getRandomValues() via rejection sampling, so the distribution is uniform. Math.random() is never used anywhere on this site.