API Key Generator

Create random API keys, client secrets, webhook signing secrets and session tokens. Pick a format — prefixed base62 like modern SaaS keys, 32-byte hex or Base64URL — and copy.

How to generate an API key

1. Choose a format, or Custom to set your own length, alphabet and prefix.
2. Check the bits of randomness — 128 or more for anything that grants access.
3. Copy the key into your secret manager or .env file. Generate several at once for multiple environments.

Designing API keys

• Enough entropy. 128 bits makes guessing impossible; 32 random base62 characters give ~190 bits, 32 bytes of hex give 256.
• A recognizable prefix such as mf_ or sk_test_ tells humans what a key is and lets GitHub secret scanning and similar tools spot leaks.
• Store a hash, not the key. Save SHA-256(key) in your database and compare hashes on each request; show the full key to the user once.
• Make keys revocable and scoped, and record a last-used time so stale keys can be cleaned up.
• Compare in constant time (e.g. crypto.timingSafeEqual) to avoid timing leaks.

Generating keys in code

// Node.js
import { randomBytes } from "node:crypto";
const key = "mf_" + randomBytes(32).toString("base64url");

# Python
import secrets
key = "mf_" + secrets.token_urlsafe(32)

# Shell
openssl rand -hex 32

Related tools

• Random String Generator
• Password Generator
• UUID generator (v4 & v7)
• JWT decoder