Random API Key Generator
Generate secure random API keys online — hex, alphanumeric, base64url, UUID v4 or prefixed formats, up to 100 at once, with entropy shown. Private.
About the Random API Key Generator
This free random API key generator creates cryptographically secure keys and tokens in your browser using crypto.getRandomValues — the same CSPRNG that powers browser cryptography. Choose a length (16 to 64 characters), pick a format — hex, alphanumeric (base62), URL-safe base64, UUID v4 or a prefixed key like sk_ — and generate up to 100 keys at once, each with its own copy button plus a copy-all option.
The tool shows the entropy of your configuration in bits, so you know exactly how strong the keys are: a 32-character base62 key carries about 190 bits of entropy, far beyond brute-force reach. Prefixed keys follow the convention popularised by Stripe — a recognisable prefix like sk_ for easy identification in logs and secret scanners, with all the randomness in the suffix.
Keys are generated locally and never sent anywhere — no server ever sees them, nothing is logged or stored. Ideal for API secrets, webhook signing keys, database passwords and placeholder credentials in seed data.
How to Use the Random API Key Generator
- 1Choose the key length and format — hex, alphanumeric, base64url, UUID v4 or prefixed.
- 2Set how many keys you need (1-100) and click Generate keys.
- 3Check the entropy readout to confirm the strength.
- 4Copy individual keys or use Copy all to grab the whole list.
Frequently Asked Questions
Are these API keys really secure and random?
Yes. Keys are produced with crypto.getRandomValues, the browser's cryptographically secure random number generator, with rejection sampling to keep every character equally likely. A 32-character alphanumeric key has roughly 190 bits of entropy — vastly more than the 128 bits generally considered unguessable.
Are the generated keys sent to a server or stored anywhere?
No. Generation happens entirely in JavaScript on your device — no network request carries the keys, nothing is logged, and refreshing the page destroys them. You can load the page, go offline, and generate keys with the network disconnected.
Which format should I choose for an API key?
Alphanumeric (base62) at 32+ characters is the best general-purpose choice: dense entropy, safe in URLs and headers, easy to double-click-select. Use hex when a system expects it, base64url for maximum entropy per character, UUID v4 when your database or spec requires UUIDs, and a prefixed key like sk_ when you want keys identifiable in logs.
What does the prefix like sk_ actually do?
Nothing cryptographic — the prefix identifies the key type at a glance (sk_ for secret keys, pk_ for publishable, following Stripe's convention) and lets secret scanners like GitHub's detect leaked keys by pattern. All the security lives in the random part after the prefix, and the entropy shown excludes the prefix.
How many bits of entropy does an API key need?
128 bits is the standard benchmark for unguessable secrets — at that strength, even scanning billions of keys per second for centuries finds nothing. That is about 32 hex characters or 22 base62 characters. Going to 190+ bits with a 32-character base62 key costs nothing and adds margin.
Can I use these as passwords or webhook secrets?
Yes — anything that needs a strong shared secret works: webhook signing secrets, session tokens, database passwords, encryption salts and seed data. For human-memorable passwords with specific character-class rules, our password generator offers symbol options and per-site tuning.