API Key Generator

How to use the API key generator

1. Choose a format, randomness target and quantity. Start with 256 bits and Base64URL unless your application specifies otherwise.
2. Open Advanced options for prefixes, character alphabets or public key IDs. Check the calculated size before generating.
3. Generate, then copy an individual key or review the export. Put production secrets in your own secrets manager, not a public document.
4. Register the secret in your application. Configure access, expiry and revocation there, then clear this page when finished.

Built for the way you use secrets

We keep the quick task quick: choose your format, generate, and copy. When your integration needs something specific, the same tool supports byte encodings, character alphabets, application labels, public key IDs and batches of up to 1,000. No account or installation is required. Use the information below to choose settings deliberately, rather than assuming a longer-looking string is always stronger.

Formats that fit your application

Base64URL avoids the plus and slash characters of ordinary Base64 and omits padding. Hexadecimal is easy to inspect and widely accepted, but uses more characters for the same random bytes. Base32 uses uppercase letters A–Z and digits 2–7 without padding here. Ordinary Base64 retains its standard padding. Always check the receiving application's format requirements; encoding is not encryption.

Custom alphabets without misleading strength labels

Character formats offer letters, digits, a defined symbol set or your own printable ASCII alphabet. Repeated alphabet characters are removed so they do not gain extra probability. The similar-character option removes 0, O, 1, I, l and |. Choose a bit target to let us calculate the needed length, or an exact character count to meet a field limit. An alphabet with fewer choices needs more characters to reach the same theoretical randomness.

Useful starting points, not service credentials

API token starts with 256-bit Base64URL. Webhook secret uses 256-bit hex when your own verification system needs a shared secret. Application secret uses 512-bit Base64URL; development batch prepares ten 256-bit tokens. These are configuration shortcuts, not universal standards or keys issued by a provider. Prefixes and suffixes help identify an application or environment, but a live_ label does not make a key active or grant any permissions.

From one key to a clean batch export

Copy individual secrets or the full batch. Optional key ID pairs provide a separate 96-bit random public identifier for looking up a credential record; keep the secret private and do not use the ID as authentication. JSON preserves exact values. TXT supports line, comma or space separators. CSV escapes cells and neutralizes formula-leading symbols, which can add an apostrophe. The .env export validates variable names and rejects incompatible quoting; it targets Node dotenv files and must not be sourced as a shell script. Downloads are plaintext secrets, not encrypted backups.

How bits, bytes and characters are calculated

For byte formats we draw ceil(target bits / 8) random bytes and report bytes × 8 nominal random bits. For N independent characters chosen uniformly from an alphabet of A distinct characters, theoretical entropy is N × log₂(A). A bit target therefore needs ceil(target bits / log₂(A)) characters. For example, a 256-bit target with digits only needs 78 digits, not 32. Fixed prefixes, suffixes and a separate public ID do not count toward secret entropy. These calculations describe the generation design; they are not a measurement or certification of your browser's random source.

One random value, different representations

32 bytes × 8 = 256 bits

These lengths exclude any prefix or suffix. Encoding changes representation, not the underlying randomness.

Our generation methodology

The generator uses the browser's crypto.getRandomValues API and requires a secure context. It never falls back to Math.random, timestamps, keyboard activity or a predictable seed. Byte encodings are lossless representations. Character generation uses rejection sampling: values in the uneven remainder are discarded before mapping bytes to characters. This avoids the bias caused by applying modulo to every byte when the alphabet size does not divide 256. Each batch is checked for repeated secrets and IDs, with bounded retries and a failure instead of an incomplete result.

What stays in your browser

Generation and export preparation happen locally. ClockTools does not send generated values to its servers or put them in URLs, analytics or persistent storage. This page starts in a fresh document without our analytics and session-replay loaders, even when you arrive from another tool. Optional saved and shared settings omit all free-text fields and all generated keys. Normal page requests still reach the hosting provider. Copying sends a value to your clipboard; downloading writes plaintext to your device. Browser extensions, clipboard synchronization, malware or someone viewing your screen can still expose it. Clear results removes them from this interface, but cannot guarantee secure erasure from browser memory or delete external copies.

Using a generated key safely

A random string becomes an API credential only when your application registers and verifies it. Configure least-privilege access, transport over HTTPS, revocation, expiration and rotation in that application. Do not embed server secrets in frontend bundles or commit them to a repository. Store production credentials in an appropriate secrets-management system. For sensitive production environments, prefer generation inside your trusted infrastructure; the Node.js, Python and OpenSSL examples let you generate fresh secrets locally without copying one from a website. No website can guarantee an uncompromised browser or device.

What we test and what tests cannot prove

Regression tests cover encoded lengths, known encoding vectors, custom alphabet validation, rejection sampling, entropy calculations, affixes, duplicate handling, exports and safe settings serialization. Browser checks exercise generation, copying, exports, language layouts and the analytics boundary. Checking a sample for duplicates or a pleasing character distribution does not prove cryptographic randomness. This tool is not independently certified, and a test of our code is not a security audit of your entire application.

Report a calculation or output problem safely

Tell us the selected format, size mode, bit or character count, quantity, browser and the steps that reproduce the problem. Use a fabricated example rather than a live key, webhook secret or customer data. Reports follow our Corrections Policy. If we confirm a material generation or export defect, we should explain the affected behavior, add a regression test and state whether earlier keys need regeneration. Changing this page cannot revoke keys already registered in another system; you must replace or revoke those there.

Generate on your own machine

Examples create one fresh secret with the selected format and affixes. They never embed the displayed key or create an account, permission or expiry rule. Public key IDs and bulk generation are not included.

import { randomBytes } from 'node:crypto';
const key = randomBytes(32).toString('base64url');