API Key Generator

// Generate a credential for your system or a fixture for your tests

The generic and custom presets create random credential material. A generated string does not become active by itself. To use it in a system you control, register it through that system's credential flow, attach the intended scopes and expiry, and keep the issued value out of logs and source code.

Provider-shaped presets solve a different problem. They produce realistic OpenAI, Anthropic, Google AI, GitHub, and Stripe-shaped strings for interface mocks, redaction tests, validators, documentation screenshots, and secret-scanner fixtures. They are not issued by those vendors and cannot authenticate to their services. Create real vendor access only in the provider's own console.

// Prefix and random length are separate parts of the key

A prefix such as api_ or sk_test_ helps people and tooling identify a credential's role. It is fixed text, so it adds zero entropy. The displayed entropy is calculated only from the random part: four bits per hex character, six bits per Base64url character, or the conservative whole-bit floor for a 62-character alphanumeric alphabet.

Length means the number of random characters after the prefix, not the total visible key length and not a byte count. Select a preset when matching a fixture shape, or edit the prefix, length, and format for your own contract. Your consuming system remains the authority on its accepted syntax and minimum strength.

// Hex, Base64url, and alphanumeric formats trade density for compatibility

Hex is easy to validate and works in nearly every configuration format, but it carries four random bits per character. Base64url uses letters, digits, hyphen, and underscore for six bits per character without slash, plus, or padding. Alphanumeric output avoids punctuation and uses a 62-character alphabet, which is useful when a field accepts only letters and digits.

The generator uses rejection sampling for alphabets that do not divide evenly into 256 possible byte values. That avoids the modulo bias introduced by mapping every random byte directly into 62 alphanumeric symbols.

// Generation stays in this tab, but handling still matters

Every random character comes from crypto.getRandomValues in this browser. Nothing is sent to a generation endpoint, placed in the URL, written to browser storage, or retained in a value history. If the secure random source fails, the tool returns no weaker fallback.

Local generation removes a server from the path, but copied credentials can still leak through clipboard history, screen sharing, browser extensions, chat, build logs, or source control. Move production material directly into protected storage, grant only the access it needs, and replace it if its handling becomes uncertain.

// fair questions

Are the generated API keys real?

Generic and custom output is real random credential material, but it has no authority until you register it in a system you control. Provider-shaped output is a test fixture only. It was not issued by the named provider and grants no access to that provider's services.

Will an OpenAI, Anthropic, or Google AI-shaped key work with that provider?

No. A familiar prefix and length only make a realistic fixture for tests, mocks, screenshots, format validation, or redaction checks. Obtain actual access from the provider's official console and never paste a real vendor key into a fixture generator.

Does the API key prefix add entropy?

No. A prefix is predictable labeling. The entropy display counts only the randomly generated characters after it. Prefixes remain valuable because they help identify key types, route credentials, and let secret scanners notice likely exposure.

Should I choose hex, Base64url, or alphanumeric?

Choose the format your consuming system accepts. Hex is broadly compatible, Base64url carries more entropy per character without URL-sensitive punctuation or padding, and alphanumeric output avoids punctuation entirely. The displayed entropy lets you compare exact settings.

How long should the random part be?

Follow the contract of the system that will store and verify the key. For a new generic credential, the default Base64url random part carries 192 bits. Shorter settings remain available for exact fixtures and legacy formats, and the page calls out results below 128 bits.

Are generated keys saved or uploaded?

No. Generation happens with crypto.getRandomValues in this tab. Values are not uploaded, added to the URL, written to localStorage or sessionStorage, or kept in a generated-value history. Refreshing or closing the page loses them.