# API Key Generator

> Strong API keys and secrets with prefix support — sk_test_, pk_live_, or your own. Configurable length and charset, bulk mode.

- URL: https://generate.now/api-key
- Category: auth
- Price: free, no account required
- AI-powered: no
- Last updated: 2026-08-27

## What it does

Generate API keys and secret tokens with prefixes like sk_test_ or pk_live_ so they're scannable in logs. Pick a charset (alphanumeric, base64url, hex), set the length, and generate one or many. All randomness uses the Web Crypto API; keys never leave your browser.

## When to use it

- Issue a fresh test API key for a service in seconds
- Bulk-generate keys for seeding a multi-tenant test database
- Get a high-entropy bearer token for local dev
- Mint a webhook signing secret

## Examples

### prefix sk_test_, base64url, 32 chars

```
sk_test_a3F7zq8KvR2NxLp9wYbT5cM1jE0HsViD
```

Stripe-style test secret key.

### no prefix, hex, 64 chars

```
9f2c8a1e4b7d6035e8c2a7f1b9d4e5c3a6f8b2d7e1c4a9b3f5d8e2c6a4b1f9d3
```

256 bits of hex entropy — webhook signing material.

### prefix whsec_, hex, 64 chars

```
whsec_4f2c9a1e7b3d80652fc8e1a94b7d6035e8c2a7f1b9d4e5c3a6f8b2d7e1c4a9b3
```

Webhook signing secret — 256 bits, with a prefix scanners can recognise.

### 10 × keys, base64url, 43 chars

```
10 distinct 256-bit keys, one per line
```

For seeding a multi-tenant fixture where every tenant needs its own key.

## Frequently asked questions

### How much entropy do I need?

128 bits is comfortably resistant to brute force. Length depends on charset: 22 base64url chars ≈ 128 bits; 32 hex chars = 128 bits. The tool shows entropy live so you can size the key to your threat model.

### Why use a prefix?

Prefixes (sk_test_, pk_live_, ghp_, etc) make keys scannable in logs and source code — secret scanners use them to detect leaked credentials. They cost a few characters of length but pay back many times over in incident response.

### Are these keys safe?

The randomness uses window.crypto.getRandomValues — the same source recommended for security-sensitive use in the browser. Keys never reach a server.

### How should I store an API key on the server?

Store a hash of it, not the key. Show the full value to the user exactly once at creation, keep a hash plus a short display prefix for the UI, and verify incoming keys by hashing them. Then a database leak doesn't hand over working credentials, and you can still show users which key is which.

### What's a good prefix convention?

Something like service_env_ — sk_live_, sk_test_, whsec_. Two things fall out of it: a key in a log or a screenshot is instantly identifiable, and secret scanners can be taught the pattern. GitHub's secret scanning works this way, and a distinctive prefix means a leaked key gets flagged rather than sitting in a public repo.

### How much entropy does a key need?

128 bits is the practical floor and 256 bits costs you nothing extra. That's 22 characters of base64url or 32 hex characters at the low end. The length only matters if the randomness is real — a 64-character key from a weak source is weaker than a 22-character one from Web Crypto.

## References

- [Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html) — OWASP. How generated keys should be stored, rotated, and revoked.
- [RFC 4648: Base16, Base32, Base64 Encodings](https://datatracker.ietf.org/doc/html/rfc4648) — IETF. The encoding definitions behind the base64url and base32 output formats.
- [Crypto.getRandomValues()](https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues) — MDN Web Docs. The entropy source for every generated key.

## Related tools

- [Password Generator](https://generate.now/password): Generate strong random passwords or memorable passphrases. Length, character classes, bulk mode — all local.
- [JWT Encoder & Decoder](https://generate.now/jwt): Decode any JWT and inspect its header, payload, and signature. Encode new tokens with HS256, RS256, and more.
- [Hash Generator](https://generate.now/hash): Hash a string with MD5, SHA-1, SHA-256, SHA-512, or bcrypt. Compare two hashes side by side.