Is the random output cryptographically strong?

Yes. The tool uses crypto.getRandomValues, which is seeded from the OS CSPRNG (getrandom / BCryptGenRandom / SecRandomCopyBytes). Output entropy matches the chosen length and alphabet.

What length should I pick?

For most APIs 32 characters from a 62-character alphabet gives ~190 bits of entropy — well beyond brute-force. 16 characters (~95 bits) is the practical minimum. Add a prefix (sk_, pk_) so leaked keys are easy to grep.

Does the generated key ever leave my browser?

No. Generation is entirely local. The key only exists in your browser tab until you copy it.

api key · csprng · prefix · local

Generate API keys with real entropy

Mint cryptographically random API keys / secret tokens — pick length, alphabet, optional prefix. Uses crypto.getRandomValues. Runs entirely in your browser.

API Key Generator

Count

5 requested

Length

no prefix

Output

0 B

idle

Status

—

csprng

input · options

Length

Prefix

Preset

Alphabet

output · api keys (0)

Click Generate to mint keys

Quick Start

How to generate API keys

Each key draws bytes from crypto.getRandomValues, then maps each byte into the chosen alphabet. Use a prefix (sk_live_, pk_test_) to identify keys at a glance.

01
Pick a length
32+ chars is industry standard for API keys.
Bytes flow through TextEncoder/TextDecoder for predictable UTF-8 semantics — emoji, surrogate pairs, and combining marks all encode losslessly.
lengthUTF-8TextEncoderlosslesslive
len · raw bytes32 · UTF-8
```
32 chars
```
loaded · UTF-8MIME · ready
02
Choose alphabet
Alphanumeric is broadest. URL-safe avoids percent-encoding. No-ambiguous skips 0/O/1/l/I.
Hash and signature operations call crypto.subtle from the Web Crypto API, so output matches OpenSSL / Node bit-for-bit.
alphabetWeb Cryptosubtledeterministiclive
set · optionsalpha+num · live
```
A-Z a-z 0-9
```
options applied · livelive
03
Add a prefix
Prefixes like sk_live_ help spot keys in logs and trigger secret scanners.
Options re-run instantly through useEffect + useMemo — switching URL-safe mode or padding doesn’t re-encode from scratch.
prefixmemoisedoptionsinstantreactive
prefix · encodedsk_live_ · ready
```
sk_live_…
```
encoded · livelossless
04
Generate & copy
Hit Generate, copy all, or download as .txt.
Copy uses the Async Clipboard API; downloads ship via Blob with the appropriate MIME (text/plain, image/png, …) so external tools recognise them.
exportclipboardblobMIME-correctclient-side
ok · copiedready · done
```
Copied
```
shipped · ready to shipsuccess

Pro tips

Encoding without surprises

Always UTF-8 first

Use TextEncoder / TextDecoder for bytes ↔ string conversion. btoa alone breaks on non-ASCII.

URL-safe vs standard Base64

Standard uses +, /, =; URL-safe swaps to -, _, no padding. Don’t mix them.

Hashes aren’t passwords

SHA-256 is fast; that’s good for fingerprints, bad for passwords. Use bcrypt / argon2 for credentials.

Watch padding rules

Some decoders are strict about = padding, others auto-pad. If round-trips fail at exactly 1 or 2 bytes, check padding.

Use Web Crypto for keys

Generate cryptographic keys via crypto.subtle, never Math.random. The latter is predictable.

JWT decode ≠ verify

Decoding a JWT just splits and base64-decodes. Verification needs the issuer’s public key / shared secret.

Use Cases

When to mint API keys

Service tokens, webhook secrets, scoped credentials.

Service tokens

Per-tenant or per-service credentials. Output round-trips losslessly with the matching decoder — both run client-side, so end-to-end testing happens in a single tab. Encoding flows through TextEncoder for predictable UTF-8 semantics.

RFC-compliant

Webhook signing secrets

Symmetric key for HMAC-signed callbacks. Web Crypto's subtle.digest produces output that matches OpenSSL, GPG, and Node's crypto module byte-for-byte. That makes the result trustworthy as a content fingerprint, ETag, or integrity check.

OpenSSL-matched

Test fixtures

Deterministic-looking keys for integration tests. Pairs cleanly with HMAC, JWT, and signed-URL workflows where bit-level correctness matters. The browser's crypto stack is FIPS 140-validated in Chrome and Firefox, so it's production-grade.

lossless

CI/CD secrets

Provision a fresh value when rotating. Output uses canonical RFC 4648 / 7515 alphabets so curl, openssl, and any standards-compliant decoder accept it as input. URL-safe variants drop padding for tokens that travel in query strings.

byte-identical

One-time tokens

Email verification or password-reset links. Heavy hashing runs through useMemo so large inputs don't block typing. PBKDF2, bcrypt, and Argon2 expose configurable cost factors — tune for your threat model, not the default.

spec-grade

Bot accounts

Static credentials for internal automation. Same input plus same options always yields identical bytes. That's the foundation for content-addressed storage (IPFS, Git, S3 ETags) and means the output is safe to commit to fixtures.

production-ready

FAQ

Frequently asked questions

How is randomness sourced?

crypto.getRandomValues — the browser's CSPRNG, which seeds from the OS entropy pool.

What length should I use?

32 characters of an alphanumeric alphabet gives ~190 bits of entropy. Use 40+ for long-lived service tokens.

Why include a prefix?

Prefixes let humans and secret scanners spot keys quickly (Stripe's sk_live_, GitHub's ghp_).

Is the No-ambiguous preset weaker?

Slightly — the alphabet is smaller. Bump length to compensate if you need full entropy parity.

Is anything sent to a server?

No. Generation runs locally in your browser — keys never leave the device.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!