API Key Generator

All formats carry the same randomness; they only differ in which characters are used and how long the key is. Base62 uses letters and digits only, so keys can be double-clicked and pasted anywhere without escaping. Base64URL is compact and safe in URLs; hex is the most widely accepted; Base32 avoids lower case for systems that ignore letter case.

128 bits of randomness is already impossible to guess by brute force; 256 bits is the common choice for API keys and signing secrets and matches the key size of HMAC-SHA-256 and AES-256. Longer keys don't make guessing any more realistic but can be required by specific systems. What matters more is that the randomness is real: keys here come from crypto.getRandomValues, and Base62 characters are drawn with rejection sampling so every character is equally likely.

Many services prefix their keys — sk_live_ for Stripe secret keys, ghp_ for GitHub tokens — so people and tools can tell what a key is and where it belongs, and so secret scanners can spot a leaked key in code. A prefix adds no security by itself; the random part does. On the server, store a hash of each key rather than the key: if the database leaks, the keys can't be used. Because API keys are long and random, a fast hash like SHA-256 is enough (unlike passwords, which need slow hashes such as bcrypt or Argon2).

Show a new key to its owner once, then only keep the hash. Never commit keys to source control; use environment variables or a secrets manager. Give each client its own key so you can revoke one without affecting others, rotate keys regularly, and scope them to the minimum permissions needed. This page doesn't keep the keys it shows, so copy them before leaving.