API Key Generator
Generate API keys and tokens from your browser’s cryptographic random source, with an optional prefix in the style most providers use. Keys are generated locally and never transmitted — a key a server has seen is not a secret.
How it works
What makes a key strong
Only one thing: the number of bits of real randomness behind it. Length in characters is a proxy, and a misleading one — a 64-character key derived from a timestamp has almost no entropy.
32 random bytes (256 bits) is the usual choice for an API key and is far beyond brute force. 16 bytes (128 bits) is the practical floor. The encoding — hex, base64url or alphanumeric — changes only how long the string looks, never how strong it is.
Why prefixes are worth using
Stripe popularised sk_live_ and pk_test_, and the pattern spread because it solves real problems:
- Secret scanning. GitHub and similar scanners match known prefixes, so a leaked key can be detected and revoked automatically.
- Environment safety. A visible
liveortestmarker makes it obvious when a production key has been pasted into the wrong config. - Triage. Support can identify a key’s type from its prefix without needing the secret itself.
Storing and handling keys
Store a hash of the key, not the key itself — treat your key table the way you would a password table, so a database leak does not hand over working credentials. Show the key once at creation and never again.
Give every key an expiry and make rotation routine rather than an incident response. Never commit keys to a repository or paste them into a chat; use environment variables or a secret manager.
What people use it for
- Creating a key for a local service or a development environment.
- Seeding test fixtures that need realistic-looking keys.
- Generating a webhook signing secret.
- Producing a one-off token for a script or an internal tool.
- Choosing a key format before implementing issuance in your own system.
Nothing is uploaded. This tool runs entirely in JavaScript in your browser. Your input is never sent to a server, never logged and never stored, and no account is required. Once the page has loaded you can go offline and it still works — open your browser's network tab and watch if you'd like to confirm it.
Frequently asked questions
Is it safe to generate a production key in a browser?
The randomness is cryptographically secure and nothing is transmitted, so it is far safer than most online generators. Even so, generating secrets on the machine that will use them is the better habit, for example openssl rand -base64 32.
How many bytes should a key be?
32 random bytes, giving 256 bits, is the common choice and well beyond brute force. 16 bytes is the practical minimum. The encoding changes the visible length, not the strength.
Why add a prefix like sk_live?
Secret scanners match known prefixes, so a leaked key can be revoked automatically. A visible live or test marker also makes it obvious when a production key has reached the wrong environment.
Should I store API keys in my database?
Store a hash of the key, not the key itself, exactly as you would with passwords. Show the key once at creation. A database leak then does not hand over working credentials.
Are generated keys sent anywhere?
No. They are produced in your browser with crypto.getRandomValues and never transmitted.
Tools that run where your code is
This page does its work in your browser because sending your data to a server to process it is a bad default. Catalase applies the same idea to AI coding: a free, open-source code editor that runs language models on your own machine through Ollama, with no account and no telemetry. Cloud models are there when you choose one, not by default.
Related tools
- Random string generator — Arbitrary-length secure strings.
- UUID generator — Random version 4 UUIDs.
- Hash generator — Hash a key before storing it.