Home › Generators › API Key Generator
API Key Generator
Create a secure random API key in seconds. Choose the format, set the length, add an optional prefix such as sk-, and generate one key or a whole batch. The keys are made in your browser with a cryptographically secure random source — nothing is sent to a server.
Grouping adds dashes every 4 or 8 characters for easier reading.
How it works
An API key is a random string that a program sends with each request to prove it is allowed to use a service. The service looks the key up, checks that it is valid, and decides what the caller may do. Because the key is the only proof, it must be long and random enough that nobody can guess it — and it must be kept secret, just like a password.
This generator offers four formats. Hex uses only the digits 0 to 9 and the letters a to f, so it never breaks a URL, a shell command, or a config file. Base64url uses letters, digits, a dash, and an underscore, packing more randomness into the same length while staying safe in URLs. Alphanumeric uses upper- and lowercase letters plus digits, which is easy to read and type by hand. UUID-style follows the familiar 8-4-4-4-12 pattern with dashes, which some systems expect by shape.
Length is the main security control. Each hex character carries 4 bits of randomness, so a 32-character hex key holds 128 bits — far beyond guessing. A 32-character base64url key holds about 192 bits. Use 32 characters as your default, go longer for keys that will live for years, and avoid anything under 16 characters for real use. The optional prefix, such as sk-, is only a label: it makes the key easy to spot in logs and code, and it helps you tell a secret key from a public one at a glance.
Grouping adds dashes every 4 or 8 characters to make a long key easier to read and copy by hand. The keys are generated with the browser's Web Crypto API, which draws from the operating system's secure random source — the same source used for TLS and password generation. Nothing leaves your device, and every click of Generate keys produces a fresh set.
Worked example
Suppose you are setting up a small shop's ordering system and it asks for a secret API key. You want a hex key, 32 characters long, with the prefix sk-, and you only need one. Set the format to Hex, the length slider to 32, the prefix to sk-, and the count to 1, then press Generate keys.
The tool produces one key that always has exactly this shape: the three characters sk-, followed by 32 lowercase hex characters (digits 0 to 9 and letters a to f), for a total length of 35 characters. One key it produced with exactly these settings was:
Your own click will produce a different random key, but it will always match that shape: sk- plus 32 hex characters, 128 bits of randomness. Copy it with the Copy button next to it, paste it into your system's secret key field, and store a backup in a password manager — never in a public file or a shared chat.
FAQ
What is an API key?
An API key is a long random string that identifies a program or a user when it talks to an API. You send the key with each request, and the service checks it to decide whether the request is allowed. It works like a password for software: it proves who is calling, but it does not carry any permissions by itself.
Which key format should I choose?
Hex is the safest default because it only uses the digits 0 to 9 and the letters a to f, so it never breaks a URL or a config file. Base64url packs more randomness into fewer characters and is also URL-safe. Alphanumeric is easy to read and type by hand. UUID-style keys follow the standard 8-4-4-4-12 pattern, which is best when a system expects that exact shape.
How long should my API key be?
Use at least 32 characters for anything real. A 32-character hex key has 128 bits of randomness, which is far beyond what anyone can guess or brute-force. Longer keys, such as 48 or 64 characters, are fine too, but there is no practical benefit past 64 characters for most services. Short keys under 16 characters are only suitable for throwaway test data.
What is the prefix for?
A prefix, such as sk-, marks a key so it is easy to recognise and to search for in logs and code. Many real services do this: a key that starts with sk- is visibly a secret key, and a key that starts with pk- is visibly a public key. The prefix does not add security — it is just a label that sits in front of the random part.
Are these keys safe to use in a real project?
Yes. The keys are generated in your browser with the Web Crypto API, which is the same cryptographically secure random source browsers use for their own security features. Nothing is sent to a server. Even so, treat a key like a password: store it in a secrets manager or an environment variable, never commit it to a public repository, and rotate it if it ever leaks.