API Key & Secret Generator

Generate secure API keys and secrets

API keys, client secrets, session tokens and webhook signing secrets all need the same thing: enough unpredictable randomness that nobody can guess them. This generator uses your browser's cryptographic random source (crypto.getRandomValues) and lets you choose the encoding, length and an optional prefix. The key is generated locally and never leaves your machine — safe to use for real production secrets.

Which format should I use?

• Base64url — compact and URL/JSON-safe (only A–Z a–z 0–9 - _). The best default for tokens that travel in URLs, headers or config files.
• Hex — only 0–9 a–f. Longer for the same entropy, but unambiguous and easy to log; common for signing secrets.
• Alphanumeric — A–Z a–z 0–9, no symbols. Handy when a key must be copied by hand or used where symbols cause trouble.

How much entropy do I need?

For secrets, aim for at least 128 bits of entropy; 256 bits is a comfortable margin for long-lived keys. The tool shows the entropy for your chosen length and format so you can size it correctly. As a guide, 128 bits is about 32 hex characters, or roughly 22 Base64url characters. More entropy costs you nothing here, so err on the generous side for anything long-lived.

Using a prefix

Many platforms prefix keys to make them identifiable — Stripe uses sk_live_, GitHub uses ghp_. A prefix doesn't add security, but it helps humans and secret-scanning tools recognise a leaked key instantly. Add your own prefix in the field above; the random body keeps its full entropy regardless.

Handle secrets responsibly

A generated key is only as safe as how you store it. Never commit secrets to source control, never log them, and rotate them periodically or immediately after any suspected exposure. Keep the canonical copy in a secrets manager or environment variables, not in code. When you must store a derived credential that will be checked later, hash it — see our bcrypt tool for password-style secrets and the HMAC generator for signing.