Generate an API key online with cryptographically secure browser randomness. Choose hex, base64url, alphanumeric, or UUID v4 — optional prefix, up to 10 keys, nothing uploaded.
Also searched as: api key generator · generate api key online · secure api key generator · hex api key generator
Uses crypto.getRandomValues(). Keys are never sent to any server.
Step-by-step guide to get the most from this tool
Select hex, base64url, alphanumeric, or UUID v4 depending on what your API expects.
For non-UUID formats choose 16–64 bytes, add an optional prefix (e.g. sk_), and set how many keys to create (1–10).
Click Generate to draw fresh cryptographically random values in your browser.
Copy each key once, save it in a secrets store or .env file that is gitignored, then leave the page.
What makes this tool stand out
Uses crypto.getRandomValues and crypto.randomUUID — not Math.random().
Hex, base64url, alphanumeric, and UUID v4 for common API styles.
Choose entropy size for non-UUID keys; hex length scales with bytes.
Prepend labels like sk_ or pk_ when your convention needs them.
Create up to 10 keys in one pass with per-key copy.
Runs client-side only — keys never leave your browser.
What happens under the hood — and how to use it well
An API key generator creates opaque secret strings your backend or SaaS product can recognize. This free online tool never invents “fake crypto”: it asks the browser for entropy via crypto.getRandomValues() (and crypto.randomUUID() for UUID v4), then encodes those bytes into the format you choose. No Math.random(), no server round-trip, and no key history stored on Tool Reign.
For hex, base64url, and alphanumeric modes you pick 16, 32, 48, or 64 bytes of raw randomness. Hex doubles the character count (each byte becomes two hex digits). Alphanumeric mode draws from a 62-character alphabet with rejection sampling so every character is unbiased. UUID mode ignores the byte slider and emits a standard RFC 4122 version-4 UUID. Longer byte lengths make brute-force guessing harder when the string is used as a shared secret; pick what your API docs require, then err on the longer side when you control both ends.
Optional prefixes (for example sk_ or pk_live_) help humans recognize environment or product at a glance; the random suffix still carries the entropy. Quantity 1–10 lets you mint a small batch for multiple services in one click. Shareable URL state can reopen the same options (not the secret values themselves) so teammates get the same workflow without re-picking formats.
Treat every generated value as a password. Put it in environment variables or a vault, never in source control or screenshots. Use a distinct key per environment and rotate on staff changes or suspected leaks. If you only need a public identifier, prefer UUID or a non-secret token — reserve long random keys for privileged access. Prefer short-lived tokens when your provider supports rotation or scopes.
Because generation is local, closing the tab clears the display (aside from anything you copied). That privacy model matches the rest of Tool Reign: useful developer utilities without uploading your secrets. Clear clipboard history on shared machines after pasting into a secrets store.
More free utilities you might find useful
Quick answers to common questions
Choose a format (hex, base64url, alphanumeric, or UUID v4), pick a byte length if needed, optionally add a prefix, set quantity (1–10), then click Generate. Copy any key with one click. Everything runs in your browser.
Keys are produced with the Web Crypto API: crypto.getRandomValues() for byte streams and crypto.randomUUID() for UUID v4. That is cryptographically secure randomness from your browser — not Math.random().
Hex (two hex digits per byte), base64url (URL-safe Base64 without padding), alphanumeric (A–Z, a–z, 0–9), and UUID v4. Non-UUID formats support 16, 32, 48, or 64 bytes of entropy.
Byte length is the amount of raw entropy before encoding. Hex output is twice as long in characters (32 bytes → 64 hex chars). Longer keys resist brute-force guessing better when used as secrets.
Yes. Set Quantity from 1 to 10 to create a batch in one click. Each key has its own copy control.
No. Generation and display stay on your device. Nothing is sent to Tool Reign servers. Clear the page when you are done if the machine is shared.
Keep secrets in environment variables or a secrets manager — never commit them to git or paste them into public tickets. Rotate keys if they leak, give each service its own key, and prefer short-lived tokens when your provider supports them.
Processing runs in your browser. Your inputs are not sent to our servers.