API Key Generator

Runs in browser Security

Create Stripe-style prefixed API keys (e.g. sk_live_…) or plain random keys using secure browser randomness, in bulk if needed.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use API Key Generator

  1. Enter a prefix and choose the character set and length.
  2. Enable the checksum if your scanners should be able to validate keys.
  3. Set how many keys to generate and the output format.
  4. Click Generate and store only a hash of each key server-side.

API Key Generator features

  • Custom prefixes such as sk_live_, pk_test_ or your own namespace
  • Alphanumeric, lowercase, hex, Base64url, Base32 or UUID v4 bodies
  • Optional CRC32 checksum suffix (GitHub-style) for offline validation
  • Bulk generation (up to 500) as lines, JSON, CSV or .env
  • Entropy estimate with strength label and storage advice

API Key Generator example

Five Stripe-style secret keys

Input:

Prefix: sk_live_ · Length: 32 · Charset: alphanumeric

Output:

sk_live_HO3L5urC0YTOvAScLnXuA31w6hcPrJ4i
sk_live_9Zm2kQeR8tVb4Xn7Jp1LcW6aYd3FgHs0
…

Frequently asked questions about API Key Generator

Why add a prefix to API keys?

Prefixes such as sk_live_ or pk_test_ make keys recognisable in logs and secret scanners, distinguish environments, and let you identify the key type without revealing the secret part.

What is the checksum option?

It appends a 6-character CRC32 of the random part, the technique GitHub uses so that leaked-secret scanners can validate a candidate key offline before contacting the provider.

How should I store API keys on the server?

Store only a SHA-256 hash of the key (plus the prefix for lookup) and show the plain key exactly once at creation. If the database leaks, the keys remain unusable.

How much entropy is enough?

Aim for 128 bits or more: 22 alphanumeric characters, 32 hex characters or a UUID v4 (122 bits). The tool reports the entropy of your configuration.

Technical notes

The random part is built from crypto.getRandomValues. Entropy is length × log2(alphabet size): 32 alphanumeric characters carry about 190 bits, far beyond the 128-bit recommendation. The optional checksum is CRC32 of the random body encoded in base62, so it adds recognisability, not security.