API Key Generator

The generator uses the browser's Web Crypto API (crypto.getRandomValues) and rejection sampling for the random body. This creates random values locally, but security also depends on how you store, distribute, and use them.

Generation runs in your browser. Values you copy or download may remain in the clipboard, browser downloads, or device backups, so protect them accordingly.

The entropy estimate depends on the random body length and alphabet size. For example, 32 uniformly random hex characters provide 128 bits before any prefix. Choose requirements appropriate to your application and store generated secrets securely.

Hex uses only 0-9a-f (or A-F)—maximum compatibility, longer for the same entropy. Base62 (0-9A-Za-z) is compact and URL-safe without special characters. Base64URL (A-Za-z0-9-_) is used by JWTs and other formats, but choosing it alone does not create a valid JWT or service token.

You can use a generated random value as an application secret if your system accepts that format. This tool cannot issue credentials for a third-party service; obtain those through the provider's official console. Store secrets securely, avoid committing them to source control, and apply appropriate access controls.

Prefixes are only labels added to the value. They do not register or authenticate a key with the named provider, and can make the result look like a real credential when it is not. The random body supplies the estimated entropy.

Entropy (in bits) estimates how hard the key is to guess by brute force. It is calculated as body length × log₂(number of distinct characters in the alphabet). The estimate is based on the configured body alphabet and length, and assumes uniform random selection. It does not account for handling, exposure, or the requirements of a particular service.

Yes. Set the count from 1 to 50. Each key is generated independently. You can copy them individually or export the whole batch as text, JSON, or CSV.

UUID v4 provides 122 bits of random entropy and is convenient when you need a standardized 36-character (or 32-character hyphen-free) identifier. For high-security secrets many teams prefer longer custom-format tokens with 256 bits of entropy.

Any Unicode characters you supply. Duplicates are removed automatically; the alphabet must contain at least two distinct characters. Entropy is computed from the unique character count.