API Key Generator

Six formats: Hex (0-9, a-f), Base64 URL-safe (A-Z, a-z, 0-9, -, _), UUID v4 (standard 8-4-4-4-12 format), JWT-style (three dot-separated base64url segments), Alphanumeric (A-Z, a-z, 0-9), and Numeric (0-9 only). Each has different entropy per character — hex gives 4 bits/char, base64 gives 6 bits/char.

Yes. All keys are generated using crypto.getRandomValues() — the Web Crypto API backed by your OS's CSPRNG. This is the same source used by TLS, password managers, and secure token libraries. Nothing is sent to any server.

For most use cases, 128-bit (32 hex chars or 22 base64url chars) is the minimum. 256-bit (64 hex chars) is recommended for long-lived keys or sensitive APIs. UUID v4 provides 122 bits of entropy. JWT-style tokens in this tool provide ~512 bits.

Prefixes help identify key type and owner at a glance. Common patterns: sk_ (secret key, e.g. Stripe), pk_ (public key), sk-live_ / sk-test_ (environment scoping), or a service abbreviation like myapp_. Prefixes don't add entropy but improve operability.

UUID is best when you need a standard interoperable identifier (databases, REST resources, logs). Hex is readable, easy to debug, and works in any context. Base64 URL is compact — 32 chars gives 192 bits of entropy vs 128 bits for hex of the same length. Use base64url for tokens stored in headers or URLs.

Never commit keys to source control. Store them in environment variables, a secrets manager (AWS Secrets Manager, HashiCorp Vault, Doppler), or your CI/CD platform's secret store. On the server side, store only a bcrypt/SHA-256 hash of the key and verify against it — never store plaintext.