API Key Generator
Issue a random API key in the format your service expects — hex, Base64, Base62 or Base32 — with an optional prefix in front. The key is drawn on your device and never leaves your browser.
An API key is the whole of the proof that a request is yours — whoever holds it can do everything you can. So it has to be drawn at random, long enough that nobody gets there by guessing, and never made up by hand. This draws one in the format your service expects, and puts your own prefix in front if you use one.
Your API key
Strength: Good, 190.5 bits
Customize
This counts the random part only, never the prefix. A key is pasted rather than typed, so extra characters cost you nothing — 32 is a sensible floor, and more is free.
Letters, digits, hyphens and underscores. A "_" is added between the prefix and the key. Editing this re-labels the key above rather than issuing a new one.
Characters used
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
Every character of the key is drawn independently from these 62, so no position is more predictable than any other.
Full length
Prefix and separator included. Some services cap the length of the header they will accept, so it is worth checking against theirs before you go long.
Recent keys
Nothing here yet. Keys you generate are kept on this device only, so you can pick one up again if you close the tab before pasting it.
What makes an API key strong
Only one thing: how many keys the one you are holding could have been. Every character here is drawn separately from the 62 shown above, so the strength is simply the length multiplied by what each character is worth — 32 Base62 characters come to roughly 190 bits, which is far past the 128 that services settle on. Nothing about the shape of a key adds to that. A memorable one is weaker, and a longer one built out of a pattern is weaker still.
The prefix is a label, not a secret. It says which service and which environment the key belongs to, so a key found in a log or a public repository can be recognised and switched off without anyone having to try it first. It travels with every request the key is used in, which is exactly why it is not counted in the strength shown above.
Treat the key itself the way you would a password. Keep it out of your source code and in an environment variable or a secret store, give each service and each environment its own, and replace it on a schedule rather than only after something goes wrong. A key you can replace in a minute is one a leak barely costs you.
Once it is pasted, this is the last place the key exists. Nothing here is registered with anyone, so a key becomes real only when the service you give it to accepts it — and if you lose one before then, generating another is the fix.
Everything happens on your device. Your API keys never leave this browser.