🗝️ API Key Generator

⚡ Quick preset

Apply a curated shape (Stripe, GitHub PAT, OpenAI, Slack, AWS, UUID v4, etc.) — populates the format, length, prefix, and separator fields and generates a fresh key.

🔧 Output format

UUID v4 is fixed-shape (36 chars, 122 bits of entropy). Bearer token is fixed at 32 bytes (256-bit entropy) encoded as base64url. Base64 formats consume byteCount random bytes and produce a string sized accordingly. Character-based formats sample length chars from the chosen alphabet.

📏 Size

🏷️ Prefix & separator

📦 Bulk generate

🔑 Generated key

{{ output || 'Click Generate to produce a key.' }}

📊 Entropy estimate

{{ entropyLabel }} {{ entropy.bits }} bits

Weak < 80 bits · Adequate 80–127 · Strong 128–191 · Overkill ≥ 192. Aim for at least 128 bits for any long-lived secret (NIST SP 800-63B).

📦 Batch output ({{ bulkCount }} keys)

⚠️

ℹ️ About API Key Generator

What this tool does

The API Key Generator produces cryptographically random API keys, bearer tokens, and signing secrets in nine standardized formats. Every byte comes from a CSPRNG — crypto.getRandomValues() in the browser, Node's crypto.randomBytes() / webcrypto on the server. The tool never calls Math.random(), which is unsuitable for security-sensitive output.

Output is shaped to mimic the conventions used by major issuers: Stripe's sk_live_ prefix, GitHub Personal Access Tokens (40-character lower-case hex or the newer ghp_ form), OpenAI's sk- keys, Slack's xoxb- bot tokens, AWS Access Key IDs (AKIA prefix), RFC 4122 v4 UUIDs, and Stripe/Svix-style whsec_ webhook signing secrets.

Nine output formats

  • hex — lower-case hex (0-9, a-f), 2 characters per random byte (4 bits each).
  • base64 — standard base64 alphabet (RFC 4648 §4) with +/ and = padding.
  • base64url — URL-safe base64 (RFC 4648 §5) with -_ and no padding — safe in URLs, cookies, and HTTP headers.
  • alphanumeric — 62-character mixed alphabet (A-Z, a-z, 0-9) using unbiased rejection sampling.
  • alphanumeric-upper — 36-character uppercase + digits (A-Z, 0-9). Matches AWS Access Key IDs.
  • alphanumeric-lower — 36-character lowercase + digits (a-z, 0-9).
  • urlsafe — 64-character set (A-Z, a-z, 0-9, '-', '_'). Same characters as base64url, packed at 6 bits per char.
  • uuid-v4 — RFC 4122 §4.4 UUID. 122 random bits; version (4) and variant (10) bits are forced.
  • bearer — 32 random bytes encoded as base64url. 256 bits of entropy. Drop-in Authorization: Bearer ... token.

Algorithm strength — entropy guide

Entropy is measured in bits — each bit doubles the expected number of guesses an attacker must try. The classifications below mirror NIST SP 800-63B and OWASP guidance for long-lived secrets.

Range (bits) Classification Use case
< 80 Weak Avoid for production. Susceptible to brute force on commodity hardware.
80 – 127 Adequate Short-lived sessions, CSRF tokens, single-use codes.
128 – 191 Strong Long-lived API keys, OAuth bearer tokens, session secrets. NIST minimum recommendation for long-lived secrets.
≥ 192 Overkill Webhook signing secrets, master keys, KEKs. Equivalent to AES-256 key strength.

Use cases

  • API authentication — issue per-customer API keys to identify and rate-limit callers.
  • Bearer tokens for HTTP Authorization headers (OAuth 2.0, JWT-adjacent).
  • Webhook signing secrets — share a 256-bit (or longer) secret used to HMAC outbound webhooks.
  • Session identifiers — opaque cookie values that can't be guessed or forged.
  • Service-to-service credentials — pre-shared secrets between trusted internal services.
  • Invitation / signup codes — short-lived, single-use tokens emailed to new users.
  • Account-recovery tokens — high-entropy one-time URL fragments.
  • Encryption keys for symmetric ciphers (use the hex or base64url format with the right byte length for AES-128 / AES-256).

CSPRNG-only — never Math.random()

Math.random() is a pseudo-random number generator seeded from a small integer. Its output is statistically uniform but trivially predictable to an attacker who can observe one sample — fine for shuffling a deck of cards, catastrophic for an API key. This tool only uses cryptographically secure RNGs:

Standards and references

Privacy note

Generated keys are intended to be copied into a secret manager (1Password, AWS Secrets Manager, HashiCorp Vault, etc.) or your application's environment variables. Do not paste production keys into chat, screenshots, support tickets, or commit them to source control. When in doubt, rotate the key immediately and treat the older value as compromised.

API Usage Example:

POST /api/tools/security/api-key-generator
Content-Type: application/json

{
    "operation": "generate",
    "format": "bearer"
}
Ready