Is this secure enough for real API keys?

Yes. We use window.crypto.getRandomValues() which is cryptographically secure. A 32-byte hex key has 256 bits of entropy — more than enough for most use cases.

What is token entropy?

Entropy measures how unpredictable a token is. It's calculated as log2(charset_size ^ token_length). Higher entropy = harder to brute-force. 128 bits is considered secure for most applications.

How many bytes should an API key or secret be?

For API keys, session secrets, and JWT signing keys, 32 bytes (256 bits) is the common standard. OAuth state parameters need only 16 bytes; for extra-sensitive signing secrets use 64 bytes.

What is the difference between hex, Base64, and Base64URL?

Hex uses two characters per byte and is safe everywhere. Base64 is more compact but contains + / = that need escaping in URLs. Base64URL swaps those for - and _ so tokens are safe in URLs and headers.

Is a UUID v4 random enough to use as a secret?

A UUID v4 has 122 random bits — fine as an unguessable identifier or idempotency key. For signing secrets and API keys, prefer 32 raw random bytes, which packs more entropy into a compact string.

Where should I store generated tokens?

In environment variables or a secrets manager — never hard-coded in source or committed to git. Reference them through .env files, GitHub Actions secrets, or Kubernetes secrets, and rotate them periodically.

Will these tokens work in .env files and YAML configs?

Yes. For maximum compatibility choose hex or alphanumeric output, which contain no symbols that need quoting. Base64 tokens with + / = should be wrapped in quotes in .env files to avoid parsing errors.

API Key & Token Generator — Generate Secure

How to use Token & API Key Generator

Generate cryptographically secure random tokens, API keys, secrets, and session IDs of any length in any format — hex, Base64, Base64 URL-safe, alphanumeric, or UUID v4. All generation uses the Web Crypto API (window.crypto.getRandomValues) for security-grade entropy. Essential for creating API keys, CSRF tokens, session secrets, OAuth states, webhook signing secrets, and JWT signing keys.

Select the output format: hex, Base64, Base64URL, alphanumeric, or UUID v4.
Set the byte length (32 bytes = 256 bits is recommended for API keys and secrets).
Click Generate to produce a new token.
Click Copy to copy it to your clipboard for use in .env files or config.
Click Generate Again for a new token without reloading the page.

Your data never leaves your device — 100% private processing.

Choosing the right format and length

Hex encoding represents each byte as 2 hex characters, so 32 bytes → 64 hex characters. Base64 is more compact: 32 bytes → 44 Base64 chars. Base64URL replaces + and / with - and _ for safe use in URLs and HTTP headers without URL encoding. For API keys meant to be typed or read, use alphanumeric (letters + numbers only, no symbols). For JWT signing secrets, use 32–64 random bytes in Base64. For OAuth state parameters, use 16+ bytes in Base64URL. UUID v4 is a 128-bit random value in the standard format (xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx).

Format	32-byte output length	Safe in URLs	Use case
Hex	64 chars	Yes	API keys, hashes, tokens
Base64	44 chars	No (has +/=)	JWT secrets, env vars
Base64URL	43 chars	Yes	OAuth state, URL params
Alphanumeric	~43 chars	Yes	Shareable codes, invites
UUID v4	36 chars	Yes	Record IDs, idempotency keys

Using tokens in .env files and CI/CD

Generated tokens are commonly used as environment variables in .env files, GitHub Actions secrets, and Kubernetes secrets. Always store tokens in environment variables — never hardcode them in source code. For .env files, wrap tokens that contain special characters in double quotes. For GitHub Actions, add the token as a repository or organization secret and reference it as ${{ secrets.MY_TOKEN }}. For Kubernetes, encode the token in Base64 before creating a secret manifest. Rotate tokens regularly, and use short-lived tokens (JWT with short exp claim) where possible over long-lived static secrets.

Worked examples

32-byte hex API key

Inputs: format hex · 32 bytes

Result: 64 hex chars, e.g. 3f9a…c1 (256-bit)

UUID v4

Inputs: format UUID v4

Result: 36 chars, e.g. 9b1deb4d-…-7d1b (122 random bits)

Glossary

CSRF token: A random value embedded in forms to prevent Cross-Site Request Forgery attacks — must be unpredictable.
JWT secret: A shared signing key used to create and verify JSON Web Tokens — must be at least 256 bits of random entropy.
Base64URL: A URL-safe variant of Base64 encoding that replaces + with - and / with _ to avoid issues in URLs and HTTP headers.
Idempotency key: A unique token sent with API requests to ensure the operation is processed exactly once, even if retried.

Related Generators

Passphrase Generator

Generate memorable, strong passphrases from random words with custom length, separators and capitalization. Crypto-random and private — nothing leaves your browser.

Phone Number Parser

Parse, validate, and format any phone number online. Get E.164, international, and national formats plus the country and line type. Free, runs in your browser.

SSH Key Generator

Generate an RSA SSH key pair in your browser with an OpenSSH public key and a PEM private key. Free, private, and runs locally with the Web Crypto API.

Password Generator

Generate strong, secure, random passwords instantly. Uses the Web Crypto API — nothing is sent to any server, so your passwords stay private.

UUID Generator

Generate random UUID v4, timestamp-based UUID v1, and ULID identifiers. Bulk-generate up to 100 at once and copy them instantly — free and private.

PIN Generator

Generate secure random PIN codes online. Choose 4, 6, 8, or custom length. Cryptographically random with options to avoid sequential and repeating digits.

Explore all Generators.

Token & API Key Generator

How to use Token & API Key Generator

Choosing the right format and length

Using tokens in .env files and CI/CD

Worked examples

Glossary

Related reading

Frequently Asked Questions

Why use Token & API Key Generator?

Common use cases

Get weekly tool tips & updates

Related Generators