UtilibyWritten by the Utiliby editorial team · Last updated October 14, 2026 · Rules and formulas reviewed October 2026
What this free API key generator does
Apps, servers and services run on secrets: API keys, session secrets, webhook signing keys, database passwords and tokens. Each one must be long, random and unguessable. A key typed by hand, or built from a date or a name, can be guessed, while a key from a proper random source cannot. This free online API key and secure token generator creates such values for you.
Pick a format such as hex, Base64, Base32, letters and numbers, or UUID, set the length, add an optional prefix, and get one or many values at once. The tool shows the exact amount of randomness in bits, and gives presets for common needs such as a JWT secret, a Laravel APP_KEY, a Django SECRET_KEY, a webhook secret or a database password. Everything runs in your browser and nothing is stored or sent.
How to use the generator
- Pick a preset or a format. Presets set the format, length and prefix for you.
- Set the length. For hex and Base64 it is the number of random bytes. For other formats it is the number of characters.
- Add a prefix and grouping if you like. A prefix such as sk_live_ makes keys easy to recognize.
- Choose the output. Plain lines, .env lines, a JSON list or CSV.
- Copy or download. Then store the values in a secrets manager.
How long is long enough
| Use | Minimum randomness | Example |
|---|---|---|
| Public IDs and short codes | 40 to 64 bits | 8 to 12 character invite code |
| Session and CSRF tokens | 128 bits | 16 random bytes |
| API keys | 128 to 256 bits | 32 hex characters or more |
| Signing keys and encryption keys | 256 bits | 32 random bytes |
| Passwords for services | 80 bits or more | 20 mixed characters |
Strength is measured in bits. Each bit doubles the number of possibilities, so 128 bits is 2^128, a number far larger than all the guesses any attacker could ever make.
Choosing a format
- Hex uses 0 to 9 and a to f, and doubles the byte count in characters. It is safe in every system.
- Base64 is shorter, and uses letters, digits, plus and slash. Use the URL-safe form in links, cookies and file names.
- Base32 avoids lowercase and look-alikes, which suits codes typed by hand.
- Letters and numbers are easy to paste almost anywhere.
- Symbols add strength per character, but some systems reject them.
- UUID gives a standard 128-bit identifier. Version 7 sorts by creation time, which databases like.
Why secure randomness matters
Programs that use ordinary random functions, such as Math.random, can produce values that an attacker can predict after seeing a few outputs. This tool uses the browser's cryptographically secure generator, which is designed for keys. For character sets, it also avoids modulo bias, a subtle flaw where some characters appear slightly more often. If the set size does not divide the random range evenly, it throws away the extra values and draws again, so every character is equally likely.
Handling keys safely
- Keep keys out of source code and public repositories. Use environment variables or a secrets manager.
- Use a different key for each service and each environment.
- Limit what each key can do, and set an expiry where the service allows it.
- Rotate keys regularly and at once if you suspect a leak.
- Store only a hash of API keys that you issue to others, and show the full value just once.
- Never send keys by email or chat. Use a password manager's sharing feature.
For developers
Prefixes help with detection. Services such as source code hosts scan commits for known key patterns, so a clear prefix lets leaks be found and revoked quickly. For keys you issue, generate at least 128 bits, store a SHA-256 hash and compare values in constant time. For signing, keep a separate key per purpose and rotate with an identifier in the token header. The .env output makes a file that frameworks read directly, and values with special characters are quoted for you.
Rotating and revoking keys
Every secret should have a plan for its end. Decide how often it will be replaced, who can replace it and how the application will accept the new value without downtime. A common approach is to allow two valid keys during a short overlap: create the new key, deploy it, check that traffic uses it and then revoke the old one. Record which key is used where, so a leak can be traced and fixed quickly. If a key appears in a public place, revoke it at once, since automated tools scrape repositories within minutes. Removing the file from the repository history is not enough, because the old value must be assumed to be known.
Making keys from the command line and in code
| Where | Example for 32 random bytes |
|---|---|
| OpenSSL | openssl rand -hex 32 |
| Python | python -c "import secrets; print(secrets.token_hex(32))" |
| Node.js | node -e "console.log(require('crypto').randomBytes(32).toString('hex'))" |
| Laravel | php artisan key:generate |
Use these in scripts and pipelines where you need many keys. The browser tool is handy when you only need a quick value or want to compare formats.
Privacy, limits and responsible use
Values are created in your browser and are never transmitted or saved. They are visible on your screen, so use a private device. The printed report hides the values unless you choose to include them. Generated keys are random, but a key only works if the service you use accepts it, and many providers issue their own. Follow the rules of each service, and do not use generated values to impersonate or access systems that are not yours.
Frequently asked questions
What is an API key generator?
A tool that creates long random strings that can be used as API keys, secrets, tokens or passwords. This one uses your browser's secure random generator.
How do I generate an API key for free?
Pick a preset or a format, set the length, and press Make new values. Copy the value or download it as a file.
Are the keys really random?
Yes. They come from the browser's cryptographically secure generator, and character sets are sampled without bias.
Are the keys sent or stored?
No. They are created in your browser and not sent, saved or logged.
How long should an API key be?
At least 128 bits of randomness, which is 16 bytes or 32 hex characters. 256 bits (32 bytes) is the common choice for secrets and signing keys.
Hex or Base64: which is better?
Both carry the same strength per byte. Hex is simple and safe in any text field. Base64 is shorter. Base64 URL-safe avoids characters that cause trouble in web addresses.
What is a prefix for?
A readable start such as sk_live_ shows what kind of key it is and helps secret scanners find leaked keys. The prefix adds no strength.
What is a UUID?
A 128-bit identifier written as 32 hex digits in groups. Version 4 uses 122 random bits. Version 7 starts with a timestamp so values sort by time.
Can I use a UUID as a secret?
A v4 UUID has 122 random bits, which is enough in theory, but many libraries do not use a secure source. Use a purpose-made random key for secrets.
What is a JWT secret?
A secret used to sign JSON Web Tokens with HMAC. Use at least 256 bits of random data, kept private on the server.
How do I make a Laravel APP_KEY?
Use the Laravel APP_KEY preset. It makes 32 random bytes in Base64 with the base64: prefix that Laravel expects.
How do I make a Django SECRET_KEY?
Use the Django preset for 50 random characters. Keep it out of version control and load it from an environment variable.
Where should I store the keys?
In environment variables or a secrets manager, never in source code, chat or public repositories. Rotate a key if it may have leaked.
Why leave out look-alike characters?
For codes that people read or type, characters such as 0 and O or 1 and l cause mistakes. Leaving them out slightly lowers the strength per character.
Can I make many at once?
Yes. Up to 50 at a time, as lines, .env entries, a JSON list or CSV.
What does the print option include?
The settings and strength. The generated values are included only if you tick the box.
Is it free?
Yes. It is free to use online with no sign-up.
Sources and further reading
- NIST SP 800-90A and SP 800-133, random bit generation and key generation (nist.gov).
- OWASP Cryptographic Storage and Session Management Cheat Sheets (owasp.org).
- RFC 9562, Universally Unique IDentifiers (UUIDs), and RFC 4648, Base-N encodings (rfc-editor.org).
- MDN Web Docs, Crypto.getRandomValues() (developer.mozilla.org).
- Laravel and Django documentation on APP_KEY and SECRET_KEY.
Sources were consulted in October 2026. Standards and rules can change, so always check the official page for your situation.