API Key Generator

Yes. Keys are produced with the browser’s Web Crypto API (crypto.getRandomValues), the same CSPRNG used for TLS and other security-sensitive operations. Rejection sampling avoids modulo bias so every character is uniformly distributed over the chosen alphabet.

No. Generation is 100% client-side. Nothing is transmitted, logged, or saved on any server. Closing the tab discards the values unless you copy or download them yourself.

128 bits of entropy is the practical minimum for production; 256 bits is a common modern default. Roughly, 32 hex characters ≈ 128 bits, 32 alphanumeric characters ≈ 190 bits, and 43 Base64URL characters ≈ 256 bits. Prefer longer keys for long-lived secrets.

Hex uses only 0-9a-f (or A-F)—maximum compatibility, longer for the same entropy. Base62 (0-9A-Za-z) is compact and URL-safe without special characters. Base64URL (A-Za-z0-9-_) is the standard for JWT and many token formats and yields slightly higher entropy per character.

Yes, provided you treat them like passwords: store them in a secrets manager or environment variables, never commit them to source control, rotate them periodically, and scope permissions tightly. The generator only creates the random material; access control and rotation remain your responsibility.

Prefixes identify the key type and environment (live vs test, secret vs publishable) at a glance and reduce the risk of accidentally using a secret key in a client-side context. The random body after the prefix still supplies the full entropy.

Entropy (in bits) estimates how hard the key is to guess by brute force. It is calculated as body length × log₂(number of distinct characters in the alphabet). Values under 64 bits are weak; 128+ bits are suitable for most API secrets; 256+ bits are excellent for long-lived or high-value tokens.

Yes. Set the count from 1 to 50. Each key is generated independently. You can copy them individually or export the whole batch as text, JSON, or CSV.

UUID v4 provides 122 bits of random entropy and is convenient when you need a standardized 36-character (or 32-character hyphen-free) identifier. For high-security secrets many teams prefer longer custom-format tokens with 256 bits of entropy.

Any Unicode characters you supply. Duplicates are removed automatically; the alphabet must contain at least two distinct characters. Entropy is computed from the unique character count.