API Key & Token Generator — Random Hex, Base64 and Prefixed Keys

Random secrets for APIs, sessions, webhooks and signing keys. Pick hex, base64url, alphanumeric or a prefixed API key, see the entropy, copy.

password

—

Time to crack — by who is attacking, and how the site stored it

You don't get to choose which column applies — the site does, when it decides how to store your password. Assume the worst one. Rates are stated so you can check the arithmetic rather than trust it.

Length 20

Characters

lowercasea–z uppercaseA–Z digits0–9 symbols!@#$%^&*()-_=+[]{};:,.<>?/~

Rules the site forced on you

at least one of each type Only tick this if a site demands it. It removes possibilities, so it very slightly lowers entropy — the figure above already accounts for that. no lookalike characters Drops Il1|O0oB8S5Z2G6q9g. Useful when it will be read aloud, typed from paper, or set on a TV. shell & CSV safe Drops quotes, backticks, $, \ and friends, so it survives a script, a YAML file or a connection string.

NIST SP 800-63B-4 forbids sites from imposing composition rules — the guidance now says verifiers shall not require a mixture of character types. Plenty of sites never got the memo, so the switches are here; they just aren't the point.

Words 6

Separator

Extras

Capitalise Each Word Adds nothing an attacker doesn't expect, but some sites insist on a capital. add a digit For sites that demand a number. Worth about 5 bits — a seventh word would be worth 13. add a symbol Same story: satisfies a rule rather than an attacker.

▸ Words are drawn from the EFF long wordlist — exactly 7,776 words, so every word is worth precisely 12.92 bits no matter which one comes up. That is what makes the entropy figure above a fact rather than a guess. Six words beats a twelve-character random password, and you can actually remember it.

Digits 6

⚠ A PIN is for a device that locks after a handful of wrong tries — a phone, a SIM, a door. Read the rate-limited column and ignore the rest: a 6-digit PIN is a million options, which is fine behind a lockout and hopeless anywhere else. Never use a PIN as a website password.

Format

Bytes 32

uppercase hexA–F instead of a–f. Same entropy.

▸ Tokens are drawn straight from crypto.getRandomValues() with no modulo bias. A 128-bit token (16 bytes, 32 hex characters) can't be guessed; 256 bits is the usual choice for session secrets and signing keys.

How many 10

Uses the settings from the password tab. Each one is generated independently.

⚠ A downloaded file is a plaintext list of passwords sitting in your Downloads folder. Move them into a password manager and delete the file — don't leave it there, and don't email it.

▸ Nothing here is transmitted. Generation, analysis and the breach check all run in this page using crypto.getRandomValues() and a word list that ships with it. There is no backend, no logging and no analytics event that carries what you generate. The page loads an anonymous, cookie-free page-view counter and nothing else.

Guide — how to use the api key & token generator

Generated in your browser with crypto.getRandomValues(); nothing is sent anywhere.

1Pick a format

Hex or base64url for secrets and signing keys, alphanumeric for anything typed into a form, a prefixed key for an API you publish.

2Set the size

32 bytes (256 bits) is the standard choice. 16 bytes (128 bits) is the minimum for a secret.

3Add a prefix

A prefix such as sk_live_ makes leaked keys easy to find in logs and repositories.

4Store it as a secret

Put it in an environment variable or secret manager, never in source control.

Questions and answers

How long should an API key or token be?

At least 128 bits (16 bytes, 32 hex characters). 256 bits (32 bytes) is the common choice for session secrets, JWT signing keys and HMAC keys.

Hex, base64url or alphanumeric?

They carry the same entropy per byte. Hex is the simplest and longest. Base64url is shorter and URL-safe. Alphanumeric is the easiest to paste anywhere.

Why add a prefix to an API key?

A recognisable prefix lets secret scanners and humans spot a leaked key quickly, and tells you which system to revoke it in. The prefix adds no entropy.

Is this suitable for a JWT secret?

Yes: use 32 bytes of hex or base64url. Generate it once, keep it server-side and rotate it if it leaks.

Is anything sent to a server?

No. Tokens are created in the page with crypto.getRandomValues(). There is no backend that sees them.

Want the full story on entropy, crack times and what NIST SP 800-63B says? See the complete random password generator, which also includes a password checker and bulk export.

api key & token generator_

Guide — how to use the api key & token generator

Questions and answers

How long should an API key or token be?

Hex, base64url or alphanumeric?

Why add a prefix to an API key?

Is this suitable for a JWT secret?

Is anything sent to a server?

Related tools