API Key Generator with Prefix, Length, and Entropy

How to use the api key generator

1. Enter a prefix such as sk_live_ or leave it blank for no prefix.
2. Set the random length to determine how many characters follow the prefix.
3. Choose a character set: base62, lowercase alphanumeric, hexadecimal or base64url.
4. Set the quantity if you need to generate multiple keys in bulk.
5. Click Generate to create your keys and view the calculated entropy.

How Entropy Is Calculated

Entropy measures the unpredictability of a generated key, expressed in bits. The formula is straightforward: multiply the number of random characters by the base-2 logarithm of the character set size.

For example, a 32-character key using the 62-character alphanumeric set (a-z, A-Z, 0-9) has an entropy of 32 * log2(62) = 190.53 bits. A 64-character hexadecimal key uses a 16-character set, yielding 64 * log2(16) = 256 bits of entropy. This api key generator displays the exact entropy below every batch so you can verify that your keys meet your security requirements.

Using it as an API token generator

An API key and an API token are both random secrets, so the same generator makes either. For a token, pick the hex or base64url character set, choose a length that gives at least 128 bits of entropy (the tool shows the figure), and add a prefix such as tok_ if you want tokens to be recognizable in logs and secret scanners. Use the count field to produce a batch.

This page does not offer base58 output or a checksum suffix. If you need a signed or expiring token for sessions, a JWT is a better fit than a random string.

Rejection Sampling Explained

To guarantee that every character in your key is equally likely, this tool uses rejection sampling rather than a simple modulo operation. Cryptographic random number generators produce uniformly distributed bytes from 0 to 255. If you map these directly to a 62-character alphabet using modulo 62, the first few characters will appear slightly more often because 256 does not divide evenly by 62.

Rejection sampling fixes this bias. The algorithm calculates the largest multiple of the alphabet size that fits within 256. For a 62-character set, that threshold is Math.floor(256 / 62) * 62 = 248. Any random byte greater than or equal to 248 is discarded, and a new byte is drawn. The accepted byte is then safely reduced modulo 62, ensuring a perfectly uniform distribution across all characters.

Common API Key Formats

Different services use different conventions for their keys. Here is a reference table of common formats:

You can replicate any of these patterns by adjusting the prefix, character set, and length fields in this api key generator.

Choosing the Right Character Set

The character set determines both readability and entropy per character. Base62 (0-9, A-Z, a-z) gives about 5.95 bits per character and is safe to paste almost anywhere. Lowercase alphanumeric (a-z, 0-9) gives about 5.17 bits and avoids case confusion. Hexadecimal gives exactly 4 bits per character: easy to read, but you need more characters for the same strength. Base64url (letters, digits, hyphen and underscore) gives exactly 6 bits per character and is safe in URLs and HTTP headers.

Security Best Practices for API Keys

Generating a strong key is only the first step. Store your keys securely using environment variables or a dedicated secrets manager rather than hardcoding them into source files. Never commit keys to version control systems. If you suspect a key has been exposed, revoke it immediately and generate a replacement.

For production environments, aim for at least 128 bits of entropy. A 22-character base62 key or a 32-character hexadecimal key meets this threshold comfortably. If you need a broader authentication solution, consider pairing your keys with a bearer token generator for structured tokens, or use a password generator when human-memorizable secrets are required. You can also evaluate the randomness of existing strings using a Shannon entropy calculator.

Worked examples