Generate a Random API Key or Secret Online Free
🗝️ Generate a Secure API Key or Secret
Pick a length and format — hex, Base64, or alphanumeric — and get a cryptographically secure value instantly. Nothing leaves your device.
🔢 Length
256 bits — a strong default for most API keys and signing secrets.
🔤 Output Format
✨ Optional Extras
Quick answer: Pick a length (32 bytes / 256 bits is a strong default) and a format — hex, Base64, Base64URL, or alphanumeric — then click Generate. Every byte comes from crypto.getRandomValues, the same cryptographically secure source browsers use internally, so the exact entropy (length × 8 bits) is shown live. Add an optional prefix like sk_live_ to mimic real-world API key formats, or copy the result as a ready-to-paste .env line. Nothing is ever uploaded or stored.
- Cost: Free, unlimited keys, no signup.
- Where it runs: 100% in your browser using the Web Crypto API — no upload, no server.
- Formats: Hex, Base64, Base64URL, and alphanumeric.
- Length: 8-128 bytes (or characters for alphanumeric), fully configurable.
- Extras: Optional prefix and a ready-to-paste .env line.
- Persistence: Nothing is saved — closing the tab clears everything.
🔒 Real Randomness, Real Responsibility: The randomness is cryptographically secure, but once generated, treat it like any secret — paste it straight into your secret manager or .env file and avoid logging or sharing it.
🔤 Match Your System's Expectations: Some systems reject certain characters (like + or / from Base64) in URLs or filenames — use Base64URL or alphanumeric in those cases.
✅ Privacy: Every key is generated locally in your browser. Nothing is transmitted, logged, or stored.
✅ 100% Private: Keys are generated locally using the Web Crypto API. No data is ever uploaded to a server or stored anywhere.
Note: Nothing you generate here is saved — reloading the page clears it completely.
How to Generate an API Key or Secret Token
Choose Length
Pick how many bytes your key should contain — 32 bytes is a strong default.
Choose Output Format
Select hex, Base64, Base64URL, or alphanumeric.
Add an Optional Prefix
Add a recognizable prefix such as sk_live_ if needed.
Copy the Key
Copy the key itself, or as a ready-to-paste .env line.
🔒 Generated Entirely on Your Device
Every byte comes from crypto.getRandomValues, the browser's built-in cryptographically secure random number source — computed locally, with no upload step and no network request that contains your key.
Common Uses for an API Key / Secret Token Generator
API Authentication Keys
Generate a secure key to authenticate requests to your own API or internal service.
JWT Signing Secrets
Create a high-entropy secret for signing and verifying JSON Web Tokens.
Webhook Signing Secrets
Generate a shared secret to verify incoming webhook payloads are genuine.
.env Configuration Values
Fill in SESSION_SECRET, ENCRYPTION_KEY, or similar variables in a project's .env file.
Test & Mock Data
Generate realistic-looking API keys (with a matching prefix) for tests, demos, or documentation.
Session & CSRF Tokens
Create a random token for session identifiers or CSRF protection during development.
Why Use This API Key / Secret Token Generator?
- Fully Client-Side: The Web Crypto API generates every byte in your browser — no upload.
- Four Output Formats: Hex, Base64, Base64URL, and alphanumeric, for any system's needs.
- Exact Entropy: Real bits-of-entropy math shown live, not a vague strength label.
- Real-World Formatting: Optional prefix support mirrors how production API keys actually look.
- .env Ready: One click copies a full VARIABLE_NAME=value line.
- Batch Generation: Generate 5 at once for dev, staging, and prod environments.
- Nothing Saved: No local storage, no cookies — closing the tab clears everything.
- 100% Free & Private: No account, no tracking, no server involved.
API Key / Secret Token Generator – Complete Guide
Typing out a "random-looking" string by hand, or reusing a value you've seen before, is one of the easiest ways an API key ends up weaker than it looks. This tool draws directly from the browser's cryptographically secure random source and formats the result however your system expects it.
How This Generator Actually Works
The core of this tool is a single call to crypto.getRandomValues(), the Web Crypto API's cryptographically secure pseudorandom number generator, requesting however many random bytes your chosen length specifies. Those raw bytes are then encoded into your selected format: hex maps each byte to two characters (0-9, a-f); Base64 packs the bytes using the standard 64-character alphabet; Base64URL is the same encoding with URL-unsafe characters swapped out and padding removed; and alphanumeric mode instead draws each character directly and uniformly from a 62-symbol alphabet (A-Z, a-z, 0-9) using rejection sampling, so every character has an exactly equal chance regardless of encoding overhead. If you set a prefix, it's simply prepended to the result - it isn't counted toward the entropy, since it's fixed and known in advance.
Hex vs Base64 vs Base64URL vs Alphanumeric
| Format | Characters Used | Best For |
|---|---|---|
| Hex | 0-9, a-f (16 symbols) | Maximum compatibility, easy to read/debug |
| Base64 | A-Z, a-z, 0-9, +, / (64 symbols) | Compact storage where +/= are safe to use |
| Base64URL | A-Z, a-z, 0-9, -, _ (64 symbols) | URLs, filenames, JWTs - no escaping needed |
| Alphanumeric | A-Z, a-z, 0-9 (62 symbols) | Systems that reject any symbol characters |
How Many Bytes Do You Actually Need?
| Length | Entropy | Recommended For |
|---|---|---|
| 16 bytes | 128 bits | Reasonable minimum for most tokens |
| 24 bytes | 192 bits | Session tokens, CSRF tokens |
| 32 bytes | 256 bits | Strong default - API keys, JWT secrets |
| 48-64 bytes | 384-512 bits | High-value signing keys, root secrets |
Security and Privacy Considerations
- No Data Upload: Every generated key stays on your device.
- No Server Processing: Generation runs entirely as client-side JavaScript.
- No Storage: Nothing is written to local storage, cookies, or a server.
- Cryptographically Secure Source: Uses the same underlying randomness source as the browser itself, not a predictable pseudorandom generator.
Browser Compatibility and Technical Requirements
This API Key Generator works in modern browsers that support:
- Web Crypto API (
crypto.getRandomValues): For cryptographically secure random byte generation. - Clipboard API: For one-click copying of the generated key and .env line.
Supported Browsers:
- ✅ Chrome/Edge 11+
- ✅ Firefox 21+
- ✅ Safari 6.1+
- ✅ Mobile Chrome (Android), Mobile Safari (iOS)
Troubleshooting Common Issues
Explanation: Some systems only accept alphanumeric characters, or specifically reject characters like + and / found in standard Base64. Solution: Switch to Base64URL or Alphanumeric mode, both of which avoid symbol characters that commonly cause issues.
Explanation: Different encodings represent the same number of random bytes with different character counts - hex uses two characters per byte while Base64 uses roughly 1.33 characters per byte. Solution: This is expected; the entropy shown is what matters, not the character count.
Explanation: Every click generates a brand-new, independent random value with no way to reproduce it - that's intentional, since a reproducible "random" key defeats its purpose. Solution: Generate the key once, then copy and store it wherever both systems need to read it from (a shared secret manager or .env file).
Explanation: The .env line uses whatever you typed into the "Variable Name" field. Solution: Update that field before copying - it updates the preview live.
Frequently Asked Technical Questions
Question 1: What exactly generates the randomness?
Answer: crypto.getRandomValues(), part of the Web Crypto API, which draws from the operating system's cryptographically secure random number generator - the same underlying source browsers use for things like generating TLS session keys.
Question 2: Why isn't Math.random() used instead?
Answer: Math.random() is not specified to be cryptographically secure and can be predictable in some JavaScript engines, which makes it unsuitable for anything security-sensitive like an API key or signing secret.
Question 3: How is alphanumeric mode kept unbiased across 62 symbols?
Answer: Since 62 doesn't evenly divide 256, a naive randomByte % 62 would make some characters slightly more likely. This tool uses rejection sampling instead: any random byte of 62 × 4 = 248 or higher is discarded and re-rolled, keeping every character's probability exactly equal.
Question 4: Does the prefix count toward the entropy shown?
Answer: No. A prefix is fixed text you chose yourself, not random data, so it contributes no unpredictability - only the randomly generated portion is counted.
Question 5: Does this tool need an account, server, or API key of its own?
Answer: No. The Web Crypto API is built into every modern browser — you never need an account, backend, or API key to use this tool.
Glossary of Terms
- API Key
- A unique token used to identify and authenticate a client application making requests to an API, often passed in a header or query parameter.
- Secret Token
- A confidential random value used to sign, verify, or encrypt data - such as a JWT signing secret, webhook signing secret, or session secret.
- Entropy
- A measure, in bits, of how unpredictable a generated value is; each doubling of the number of possible outcomes adds one bit.
- Base64URL
- A variant of Base64 encoding that replaces the + and / characters with - and _ and omits padding, making the output safe to use in URLs and filenames.
- .env File
- A plain-text file, common in software projects, that stores environment-specific configuration and secrets as VARIABLE_NAME=value lines.
Frequently Asked Questions
Yes, completely free with no signup and no limit on how many keys you generate.
No. Every key is generated locally using the browser's Web Crypto API. Nothing is transmitted over the network or stored.
32 bytes (256 bits) is a strong, widely used default for API keys and signing secrets. 16 bytes (128 bits) is a reasonable minimum for less sensitive tokens, and 48-64 bytes suits high-value signing keys such as JWT secrets.
Hex represents each byte as two characters (0-9, a-f) and is the longest but simplest to read; Base64 packs bytes more densely using 64 characters including + and /; Base64URL is the same encoding with + and / replaced by - and _ and padding removed, making it safe to use directly in URLs and filenames.
The randomness itself is cryptographically secure, generated the same way via crypto.getRandomValues that security-focused applications use. As with any secret, generate it on a device you trust, copy it directly into your secret manager or .env file, and avoid pasting it anywhere it could be logged or cached.
Many real-world API keys use a recognizable prefix, such as sk_live_ or pk_test_, so systems and developers can identify a key's type or environment at a glance before even checking its value. This tool can prepend any prefix you choose to the random portion.
Length alone doesn't tell you how guessable a key is - a 64-character key using only digits is far weaker than a 64-character key using the full alphanumeric range. Bits of entropy is the standard, comparable measure of how many random guesses an attacker would need.
Yes. Enter a variable name and the tool formats the generated key as VARIABLE_NAME=value, ready to paste directly into a .env file.
Final Thoughts
A good API key or secret should never depend on hand-typed "randomness" or a value copied from an old project. Drawing directly from the browser's cryptographically secure random source, in whatever format your system expects, takes the guesswork - and the risk - out of it entirely. Pick a length above and generate your first key.
Choose your length and format above and generate your first secure key!