Overview
Introduction
API keys and access tokens need to be long, unpredictable, and often recognizably prefixed so both systems and humans can tell at a glance what kind of credential they're looking at.
This tool generates key-shaped random strings entirely in your browser, using the same cryptographic random source used for real secrets.
What Is API Key Generator?
A configurable generator that concatenates a literal prefix you choose with a cryptographically random suffix drawn from hex, base62, or base64url character sets.
Both the prefix and the random-part length are adjustable, so the output can match the shape of keys from a specific provider or your own system's convention.
How API Key Generator Works
The tool fills a typed array with cryptographically random 32-bit values via crypto.getRandomValues(), maps each value onto the selected character pool by modulo, and appends the result to your prefix.
Generation happens synchronously in the browser; nothing is transmitted anywhere.
When To Use API Key Generator
Use it to mock realistic-looking API keys for documentation examples, test fixtures, or local development environments.
It's also useful for generating one-off secrets for internal tools where you control both ends and just need a long random string with a recognizable prefix.
Often used alongside Random String Generator, Short ID Generator and UUID Generator & Validator.
Features
Advantages
- Uses a cryptographically secure random source, not Math.random().
- Custom prefix makes generated keys instantly recognizable in logs, diffs, or secret scanners.
- Three character-set options cover the common conventions used by real API providers.
Limitations
- Generated here for convenience and testing — treat any key displayed in a browser tab as non-production unless you've deliberately chosen to use it that way and understand the exposure.
- This tool has no way to register, revoke, or actually authenticate the generated key against any real system; it only produces a random string in the right shape.
Examples
Best Practices & Notes
Best Practices
- Always include a prefix on generated test keys (e.g. test_ or mock_) that clearly distinguishes them from real production credentials.
- Use at least 32 characters of randomness for anything meant to resemble a real bearer token or secret.
- Generate a batch when seeding test fixtures rather than calling the tool repeatedly for one key at a time.
Developer Notes
Prefix and random suffix are simple string concatenation with no separator enforced, matching how most real providers format their keys (prefix immediately followed by the random payload, no delimiter).
API Key Generator Use Cases
- Generating realistic placeholder keys for API documentation
- Creating mock secrets for local development .env files
- Producing test fixtures that need to look like real API credentials
Common Mistakes
- Pasting a browser-generated key straight into a production secrets manager without generating it through a trusted, audited path.
- Using a short random-part length for something meant to resemble a real bearer token, which real providers never do.
Tips
- Match your prefix convention to your provider or internal system (e.g. pk_/sk_ for publishable/secret key pairs) so generated test data is easy to distinguish at a glance.
- Use hex when the target system's key-parsing logic is case-insensitive or you're unsure, since it avoids any case-sensitivity edge cases.