API Key Generator: Cryptographically Random Keys, Not Math.random()
Generating a 'random-looking' string is easy; generating one that's actually unguessable is a different requirement entirely. This tool uses crypto.getRandomValues() — the Web Crypto API's cryptographically secure random number generator — rather than JavaScript's Math.random(), which is explicitly not designed for security-sensitive values and can, in principle, have its internal state inferred from enough output.
128 bits of entropy is a common target for API key security.
Why Math.random() Isn't Safe for Keys
Math.random() is implemented for statistical randomness (good distribution for simulations, games) but its underlying PRNG algorithm and seed aren't designed to resist an attacker trying to predict future or past outputs. crypto.getRandomValues() is backed by the operating system's cryptographic random source, specifically designed so that observing output gives no advantage in predicting other output.
Choosing a Key Length
128 bits of entropy is the common baseline for API keys — enough that brute-forcing is computationally infeasible even at massive scale. A 32-character hex string provides exactly 128 bits (4 bits per hex character). Shorter keys trade security for a more compact string; longer keys add margin at the cost of a bit more typing/storage.
Why Prefixes Matter Beyond Readability
A recognizable prefix like sk_live_ or pk_test_ isn't just cosmetic — automated tools (like GitHub's secret scanning, or your own CI pipeline) can detect a leaked key of a known format and alert immediately. An unprefixed random string is indistinguishable from any other data, making accidental leaks much harder to catch automatically.
Practical Examples
A Stripe-Style Live Secret Key
Prefixed, high-entropy, hex-encoded.
- 1.Prefix: sk_live_
- 2.Length: 32 (hex) → 128 bits entropy
- 3.Result: sk_live_a1b2c3d4e5f6...
A Compact Alphanumeric Token
More entropy per character.
- 1.Charset: Alphanumeric
- 2.Length: 24 → ~143 bits entropy
- 3.More compact than hex for the same security level
What This Tool Generates
- CSPRNG-backed keys: crypto.getRandomValues()
- Custom prefix: for identifiability
- Configurable charset: hex, alphanumeric, base64url
- Entropy display: know exactly how strong your key is
- Bulk generation: up to 20 keys at once
After Generating a Key
- Store only a hash of the key server-side, never the plaintext
- Set an expiration or rotation policy where possible
- Scope the key to the minimum permissions it needs
- Never commit keys to version control
Frequently Asked Questions
Is this actually cryptographically secure?
Yes — it uses crypto.getRandomValues(), the Web Crypto API's cryptographically secure pseudorandom number generator (CSPRNG), not Math.random(), which is not safe for security-sensitive values.
How much entropy do I need for an API key?
128 bits is generally considered strong for API keys — practically impossible to brute-force. A 32-character hex key gives you 128 bits (32 × 4 bits per hex digit); the tool shows the exact entropy for your chosen length and charset.
Why add a prefix like sk_live_?
Prefixes make keys identifiable at a glance (which service, which environment) and let automated secret-scanners detect leaked keys of a specific format. Stripe, GitHub, and many other API providers use this convention.
Which charset should I choose?
Hex is simple and universally safe to embed anywhere. Alphanumeric is more compact per bit of entropy. Base64url is the most compact but includes - and _ characters, which is fine for API keys but avoid it if the key needs to go in contexts with stricter character restrictions.
Should I store these keys as-is in my database?
No — store a hash of the key (see our API Key Hasher tool), not the plaintext key. That way, a database breach doesn't directly expose usable keys, similar to how passwords should never be stored in plaintext.
Is my generated key sent anywhere?
No, generation happens entirely in your browser using the Web Crypto API — nothing is transmitted or logged.