API key generator
Cryptographically random API keys with an optional prefix, for your own services, webhooks, test fixtures and .env files.
62-character alphabet × 32 = 191 bits of entropy per value.
Press generate to fill this table.
API key design checklist
- Use at least 128 bits from a CSPRNG. Never derive keys from user IDs or timestamps.
- Add a recognisable prefix per environment and type (
sk_live_,pk_test_) so leaks are easy to scan for. - Hash keys at rest and compare in constant time.
- Support several active keys per account so users can rotate without downtime.
Questions people ask
How long should an API key be?
At least 128 bits of randomness. With base62 that is 22 characters; RandomKit defaults to 32 characters (about 190 bits), which is well past brute-force range.
Why add a prefix like sk_live_?
Prefixes make keys easy to recognise. People can tell a live key from a test key at a glance, and secret scanners such as GitHub’s can spot leaked keys by pattern. Stripe, GitHub (ghp_) and Slack (xoxb-) all use them.
How should I store API keys on the server?
Store a hash of the key (SHA-256 is enough for high-entropy random keys), not the key itself, and show the full key to the user only once. Keep a short non-secret prefix in plain text so users can identify which key is which.