API Key Generator

Runs in browser Security

Create Stripe-style prefixed API keys (e.g. sk_live_…) or plain random keys using secure browser randomness, in bulk if needed.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How should API keys and secrets be generated and handled?

A secret is only as strong as its randomness: keys and tokens should come from a cryptographically secure generator with at least 128 bits of entropy (256 for HMAC keys), never from a password or a timestamp. RSA keys should be 2048 bits or more, kept in PEM files with restricted permissions. Secrets belong in a vault or environment configuration, rotated on a schedule, and never in source code, logs or URLs.

Security note: Anything generated here is only as private as where you paste it next. Generate keys locally, store them in a secrets manager, and rotate any key that was ever committed to a repository or shared in chat.

How to use API Key Generator

  1. Enter a prefix and choose the character set and length.
  2. Enable the checksum if your scanners should be able to validate keys.
  3. Set how many keys to generate and the output format.
  4. Click Generate and store only a hash of each key server-side.

API Key Generator features

  • Custom prefixes such as sk_live_, pk_test_ or your own namespace
  • Alphanumeric, lowercase, hex, Base64url, Base32 or UUID v4 bodies
  • Optional CRC32 checksum suffix (GitHub-style) for offline validation
  • Bulk generation (up to 500) as lines, JSON, CSV or .env
  • Entropy estimate with strength label and storage advice

API Key Generator example

Five Stripe-style secret keys

Input:

Prefix: sk_live_ · Length: 32 · Charset: alphanumeric

Output:

sk_live_HO3L5urC0YTOvAScLnXuA31w6hcPrJ4i
sk_live_9Zm2kQeR8tVb4Xn7Jp1LcW6aYd3FgHs0
…

Frequently asked questions about API Key Generator

Why add a prefix to API keys?

Prefixes such as sk_live_ or pk_test_ make keys recognisable in logs and secret scanners, distinguish environments, and let you identify the key type without revealing the secret part.

What is the checksum option?

It appends a 6-character CRC32 of the random part, the technique GitHub uses so that leaked-secret scanners can validate a candidate key offline before contacting the provider.

How should I store API keys on the server?

Store only a SHA-256 hash of the key (plus the prefix for lookup) and show the plain key exactly once at creation. If the database leaks, the keys remain unusable.

How much entropy is enough?

Aim for 128 bits or more: 22 alphanumeric characters or 32 hex characters. A UUID v4 carries 122 random bits, just under that target. The tool reports the entropy of your configuration.

Technical notes

The random part is built from crypto.getRandomValues. Entropy is length × log2(alphabet size): 32 alphanumeric characters carry about 190 bits, far beyond the 128-bit recommendation. The optional checksum is CRC32 of the random body encoded in base62, so it adds recognisability, not security.

References