[ ROOT ]
$GENERATE-RANDOM.ORG
▶ Developer Tools for Random Data Generation // v2.15.4
root@generate-random:~/api-keys$ _

Random API Key Generator

Generate secure API keys with customizable formats and optional key-secret pairs

[ API Key Generator - Quick Summary ]

What: Generate cryptographically secure API keys in 6 formats (alphanumeric, hex, base64, base64url, UUID v4, numeric). Length 8-256 chars with optional prefixes and key-secret pairs.

When to use: REST API authentication, webhook secrets, service-to-service auth, client IDs, rate limiting, CI/CD pipeline secrets, microservice authentication.

Example: sk_vR8n2KmPqL4xWj9TcFaG3dH5pN7mQrS (32 chars alphanumeric ~190 bits entropy)

Security: NIST SP 800-90A compliant CSPRNG. Suitable for production. Never expose in client code. Rotate regularly.

Our API key generator creates cryptographically secure tokens used for authenticating applications and services. Generate random API keys in multiple formats including alphanumeric, hexadecimal, Base64, Base64 URL-safe, UUID v4, and numeric formats. Perfect for REST API authentication, webhook secrets, service-to-service auth, and client application IDs. All keys use industry-standard CSPRNG to ensure maximum entropy and unpredictability. Generate single keys or bulk generate up to 25 keys at once. Optional key-secret pairs for enhanced security with separate public keys and private secrets. Export your API keys as text, CSV, or JSON for easy integration. Visit our API documentation for programmatic key generation.

What is an API Key Generator?

An API key generator creates cryptographically secure tokens used for authenticating applications and services. Our generator uses industry-standard random byte generation to ensure maximum entropy and unpredictability.

API keys provide a simple authentication method where each key uniquely identifies a client application. They're perfect for server-to-server communication and public API access control.

API Key Generator Configuration Options

API Key Format Selection

Choose from six industry-standard encoding formats, each optimized for different use cases and compatibility requirements. All formats use the same cryptographically secure random bytes as input, differing only in their encoding and character sets.
  • Alphanumeric (A-Za-z0-9): 62 characters, URL-safe, most versatile. Example: sk_vR8n2KmPqL4xWj9TcFaG. Entropy: ~5.95 bits/char.
  • Hexadecimal (0-9a-f): 16 characters, compact binary representation. Example: api_4a7f3c9e2b8d1f6a5c3e. Entropy: 4 bits/char.
  • Base64 (RFC 4648): 64 characters with +/=, most compact. Example: pk_8vR2xK/mL+3wN9Qa==. Entropy: 6 bits/char.
  • Base64 URL-Safe: Replaces +/ with -_, no padding. Example: token_8vR2xK-mL_3wN9Qa. Used by JWT and OAuth.
  • UUID v4 (RFC 4122): Standard 128-bit format. Example: key_f47ac10b-58cc-4372-a567-0e02b2c3d479. 122 bits randomness.
  • Numeric Only (0-9): Digits only, lower entropy. Example: pin_74829365018293. For PINs and verification codes.

Key Length (8-256 Characters)

Key length determines security strength through entropy. Longer keys are exponentially more difficult to brute-force. Choose length based on your security requirements and the format's entropy per character.
  • 16 chars: Minimum for development/testing (48-96 bits entropy)
  • 32 chars: Recommended for production (128-192 bits entropy)
  • 40 chars: High security for financial APIs (160-240 bits entropy)
  • 64 chars: Maximum security (256-384 bits entropy)
  • 128+ chars: Paranoid security or compliance requirements

Custom Prefixes

Add human-readable prefixes to API keys for easy identification, environment separation, and key type distinction. Following industry patterns improves developer experience.
  • sk_ Secret Key - Private keys for server-side operations (Stripe pattern)
  • pk_ Public Key - Client-side publishable keys
  • api_ API Key - General-purpose API authentication
  • test_ Test Environment - Development/staging keys
  • prod_ Production - Live environment keys

Key-Secret Pairs (Dual Authentication)

Generate matched key-secret pairs for enhanced security. The public key identifies the client (sent in requests), while the secret key proves ownership (used for signing). This prevents key exposure attacks.
  • Public Key (ID): Identifies the application/client (can be logged safely)
  • Secret Key (Credential): Proves ownership (never logged, encrypted in storage)
  • Usage: Key in request headers, secret for HMAC signatures
  • Examples: AWS Access Key ID + Secret, OAuth Client ID + Secret

Cryptographic Security Standards

All API keys are generated using cryptographically secure pseudorandom number generators (CSPRNG) that meet NIST and FIPS standards for security-critical applications.
  • Entropy Source: Operating system CSPRNG with hardware randomness
  • Standards Compliance: NIST SP 800-90A/B/C compliant
  • Unpredictability: Computationally infeasible to predict keys
  • Statistical Quality: Passes NIST randomness test suite

Common API Key Use Cases

Understanding use cases helps select appropriate format, length, and security measures.
  • REST API Authentication: Simple bearer token for HTTP APIs
  • Webhook Secrets: HMAC signing keys for payload verification
  • Service-to-Service Auth: Backend microservice authentication
  • Client Application IDs: Mobile app/SPA identification
  • Rate Limiting Keys: Track and enforce API usage quotas
  • CI/CD Pipeline Secrets: Automated deployment authentication

How to Generate Secure API Keys

[STEP 1] Configure Length

Set key length between 8-256 characters. We recommend at least 32 characters for production use.

[STEP 1] Select Format

Choose from alphanumeric, hex, base64, base64url, UUID, or numeric formats based on your needs.

[STEP 1] Optional Prefixes

Add prefixes like sk_, pk_, or api_ to identify key types and environments.

[STEP 1] Key-Secret Pairs

Enable key-secret pairs for two-factor authentication where the key identifies and secret proves ownership.

API Key Security Best Practices

  • _ Never expose API keys in client-side code or public repositories
  • _ Use environment variables to store keys in your applications
  • _ Rotate API keys regularly, especially after team changes
  • _ Implement key scoping to limit what each key can access
  • _ Use different keys for development, staging, and production
  • _ Monitor API key usage and implement rate limiting

Technical Implementation

Our API key generator employs cryptographically secure random number generation to produce tokens with maximum entropy. The system validates input parameters, generates random byte sequences, and applies format-specific encoding transformations to create the final keys.

// Mathematical entropy calculation
entropy = key_length × log₂(character_set_size)

// Character set sizes by format:
alphanumeric: 62 chars | hex: 16 chars | base64: 64 chars

// Example: 32-character alphanumeric key
32 × log₂(62) ≈ 190.3 bits of entropy

API Access for Developers

Need to generate API keys programmatically? Our API is free and requires no authentication.
GET https://generate-random.org/api/v1/generate/api-keys
VIEW FULL API DOCUMENTATION →

Frequently Asked Questions

How long should my API key be?

For most applications, 32 characters provides excellent security. Use 64+ characters for highly sensitive systems.

Which format should I choose?

Alphanumeric is the most common and compatible. Use Base64 for higher entropy in shorter keys, or UUID for standard compliance.

When should I use key-secret pairs?

Use key-secret pairs when you need two-factor authentication: the key identifies the client, while the secret proves ownership.

What are prefixes for?

Prefixes help identify key types and environments (e.g., "pk_" for public keys, "sk_" for secret keys, "test_" for test environments).