API Key Generator Developer Tool
Generate cryptographically random API keys and secrets in hex, base64url, UUID-like, or prefixed formats.
Every API integration, webhook secret, and service-to-service credential needs a value that's unpredictable enough to resist guessing. This free API key generator is a developer tool that produces cryptographically random keys in several common formats — hex, base64url, UUID-v4-like, or a prefixed style similar to what Stripe and other APIs use — entirely in your browser, with support for generating several at once.
Options
Results
Runs entirely in your browser — no data is sent anywhere.
What makes a key "cryptographically random"
An API key is only as good as the unpredictability behind it. This tool uses crypto.getRandomValues(), the Web Crypto API's cryptographically secure random number generator, rather than Math.random() — which is fast but not designed to resist an attacker trying to predict future or past output from observed values. For anything used as a credential, always generate it with a CSPRNG (a cryptographically secure pseudo-random number generator); PHP's equivalent is random_bytes() or Str::random() in Laravel, both of which are safe to use server-side for the same purpose.
Choosing a format
Hex and base64url both encode the same underlying random bytes, just with different alphabets — base64url is more compact (roughly 33% shorter for the same entropy) since it packs 6 bits per character instead of 4, and it's URL-safe, avoiding the +, /, and = characters of standard base64 that need escaping in a URL. UUID-v4-like output follows the familiar 8-4-4-4-12 hyphenated shape but isn't a real RFC 4122 UUID here — it's just formatted to look like one, since some systems expect that shape for an identifier even when it's really just a random key. The prefixed format mirrors how many real-world APIs identify their keys at a glance — Stripe's sk_live_/sk_test_, GitHub's ghp_, and so on — which lets automated secret-scanners and code reviewers recognise a leaked key instantly by its shape, and lets you tell live and test credentials apart without decoding anything.
How much randomness is enough
Length matters more than format. A key needs enough entropy that brute-forcing it is infeasible even against an attacker who can make an enormous number of guesses — 16 bytes (128 bits) of true randomness is already far beyond what's crackable with current or foreseeable computing power, and this tool defaults to 32 bytes (256 bits) for comfortable headroom. Padding a short, low-entropy key out to a long string doesn't help if the underlying randomness is thin; what matters is the number of random bytes actually generated, not the length of the final encoded string.
Storing keys safely
Never store an API key in your database the way it was issued. If your application issues its own API keys to customers, hash the key before persisting it — the same way you'd never store a password in plaintext — using the hash generator as a way to understand how that works, or better, your framework's built-in hashing (Laravel's Hash::make()). That way a database breach doesn't hand an attacker every live credential; you compare an incoming key by hashing it and checking against the stored digest, never by storing or comparing the raw value.
Beyond simple keys
A random secret generated here is also exactly the kind of value used to sign HMAC-based JSON Web Tokens — if you're building your own token-based authentication, a key from this tool can serve as the shared signing secret; see the JWT decoder for how that secret gets used to verify a token's signature. For generating strong human-memorable or randomised passwords instead of machine credentials, use the password generator.