About this tool
API Tokens and cryptographic keys represent security credentials that let third-party applications authenticate requests to your cloud servers safely. Creating high-entropy, unpredictable keys is a mandatory security requirement.
Key Space Complexity calculations
To defend against automated algorithmic lookup databases or brute-force hardware clusters, API key security relies on mathematical entropy (H), computed using the standard character selection pools:
Where:
- L represents the length parameter of your random character string.
- R is the radical size parameter of your chosen set pool (using R = 62 for complete alphanumeric characters).
This generator leverages cryptographically secure pseudo-random number generation (CSPRNG) interfaces natively inside your local browser runtime to compile high-entropy key strings securely.
Frequently asked questions
Everything you need to know about API Key & Token Generator.
What character set is used when generating API keys?
By default, keys use a 62-character alphanumeric set (A–Z, a–z, 0–9) for maximum compatibility with systems that don't support special characters. You can optionally include symbols (+, -, _, =) for additional entropy per character.
How random are the generated API keys?
Keys are generated using the Web Crypto API (crypto.getRandomValues()), which is the same cryptographic random source your browser uses for TLS. This is significantly stronger than Math.random() and is suitable for production secrets.
What key length should I use for my API keys?
A 32-character alphanumeric key provides approximately 190 bits of entropy — far beyond brute-force feasibility. For most APIs, 32–48 characters strikes the ideal balance between security and usability. JWT secrets should be at least 256 bits (32 bytes / 43 base64 characters).
Can I use this tool to generate JWT secrets?
Yes. Set the format to base64 and the length to 32 bytes (yielding a 43-character base64url string) to produce a secure HS256 JWT secret. For RS256/ES256 JWTs, you should generate an asymmetric key pair using openssl or a dedicated cryptography library instead.
Is the generated key stored or logged anywhere?
No. Keys are generated in memory inside your browser tab and displayed only to you. They are not transmitted to any server, stored in a database, or logged. Refresh the page and the key is gone.